CVE-2008-0923

Currently unrated

Key Information:

Vendor
Vmware
Status
Vmware Player
Ace
Workstation
Player
Vendor
CVE Published:
26 February 2008

Summary

Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character string containing .. (dot dot) sequences, which bypasses the protection mechanism, as demonstrated using a "%c0%2e%c0%2e" string.

References

http://www.securityfocus.com/bid/27944
vdb-entryx_refsource_BID
http://secunia.com/advisories/29117
third-party-advisoryx_refsource_SECUNIA
http://www.coresecurity.com/?action=item&id=2129
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.