Vulnerability Details : CVE-2009-1542

The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, does not enforce CPU privilege-level requirements for all machine instructions, which allows guest OS users to execute arbitrary kernel-mode code and gain privileges within the guest OS via a crafted application, aka "Virtual PC and Virtual Server Privileged Instruction Decoding Vulnerability."

Published 2009-07-15 15:30:01

Updated 2018-10-12 21:51:24

Source Microsoft Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2009-1542

Probability of exploitation activity in the next 30 days: 1.38%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 85 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2009-1542

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Source
9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C	8.0	10.0	nvd@nist.gov
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2009-1542

CWE-264

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-1542

Products affected by CVE-2009-1542

Microsoft » Virtual Pc » Version: 2007
cpe:2.3:a:microsoft:virtual_pc:2007:*:*:*:*:*:*:*
Matching versions
Microsoft » Virtual Pc » Version: 2004 Update SP1
cpe:2.3:a:microsoft:virtual_pc:2004:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Virtual Pc » Version: 2007 Update SP1
cpe:2.3:a:microsoft:virtual_pc:2007:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Virtual Pc » Version: 2007 X64 Edition
cpe:2.3:a:microsoft:virtual_pc:2007:*:x64:*:*:*:*:*
Matching versions
Microsoft » Virtual Server » Version: 2005 Update R2 Sp1
cpe:2.3:a:microsoft:virtual_server:2005:r2_sp1:*:*:*:*:*:*
Matching versions
Microsoft » Virtual Server » Version: 2005 Update R2 Sp1 X64 Edition
cpe:2.3:a:microsoft:virtual_server:2005:r2_sp1:x64:*:*:*:*:*
Matching versions