Vulnerability Details : CVE-2010-1138
The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1 build 227600, VMware Player 2.5.x before 2.5.4 build 246459 on Windows, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware Server 2.x, and VMware Fusion 3.0 before 3.0.1 build 232708 and 2.x before 2.0.7 build 246742 allows remote attackers to obtain sensitive information from memory on the host OS by examining received network packets, related to interaction between the guest OS and the host vmware-vmx process.
Vulnerability category: Information leak
Threat overview for CVE-2010-1138
Top countries where our scanners detected CVE-2010-1138
Top open port discovered on systems with this issue
80
IPs affected by CVE-2010-1138 23
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2010-1138!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2010-1138
Probability of exploitation activity in the next 30 days: 0.70%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 78 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2010-1138
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST |
CWE ids for CVE-2010-1138
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2010-1138
-
http://www.securityfocus.com/bid/39395
VMware Hosted Products 'vmware-vmx' Virtual Network Stack Information Disclosure Vulnerability
- http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html
-
http://lists.vmware.com/pipermail/security-announce/2010/000090.html
[Security-announce] VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issuesPatch;Vendor Advisory
-
http://www.vmware.com/security/advisories/VMSA-2010-0007.html
VMSA-2010-0007.1Patch;Vendor Advisory
- http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html
-
http://security.gentoo.org/glsa/glsa-201209-25.xml
VMware Player, Server, Workstation: Multiple vulnerabilities (GLSA 201209-25) — Gentoo security
-
http://www.securitytracker.com/id?1023836
VMware Networking Stack Memory Leak Lets Local Users Obtain Potentially Sensitive Information - SecurityTracker
Products affected by CVE-2010-1138
- cpe:2.3:a:vmware:workstation:6.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workstation:6.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workstation:6.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workstation:6.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:workstation:7.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:ace:2.6:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:player:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:player:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:player:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:player:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:player:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:server:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:server:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:server:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:fusion:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:fusion:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:fusion:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:fusion:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:fusion:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:fusion:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:fusion:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:fusion:2.0.6:*:*:*:*:*:*:*