Vulnerability CVE-2008-4917 - CERT Civis.Net

Vulnerability Name:

CVE-2008-4917 (CCN-47017)

Assigned:

2008-12-02

Published:

2008-12-02

Updated:

2018-11-02

Summary:

Unspecified vulnerability in VMware Workstation 5.5.8 and earlier, and 6.0.5 and earlier 6.x versions; VMware Player 1.0.8 and earlier, and 2.0.5 and earlier 2.x versions; VMware Server 1.0.9 and earlier; VMware ESXi 3.5; and VMware ESX 3.0.2 through 3.5 allows guest OS users to have an unknown impact by sending the virtual hardware a request that triggers an arbitrary physical-memory write operation, leading to memory corruption.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
5.3 Medium (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Bypass Security

References:

Source: MITRE
Type: CNA
CVE-2008-4917

Source: CONFIRM
Type: Patch, Vendor Advisory
http://kb.vmware.com/kb/1006980

Source: CONFIRM
Type: Vendor Advisory
http://kb.vmware.com/kb/1006986

Source: CCN
Type: VMSA-2008-0019
VMware Hosted products and patches for ESX and ESXi resolve a critical security issue and update bzip2

Source: CCN
Type: SA32965
VMware ESX / ESXi Virtual Hardware Memory Corruption Vulnerability

Source: SECUNIA
Type: Third Party Advisory
32965

Source: GENTOO
Type: Third Party Advisory
GLSA-201209-25

Source: CCN
Type: SECTRACK ID: 1021300
VMware Virtual Hardware Memory Access Bug Lets Local Users Gain Elevated Privileges

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1021300

Source: CCN
Type: SECTRACK ID: 1021301
VMware ESX Virtual Hardware Memory Access Bug Lets Local Users Gain Elevated Privileges

Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1021301

Source: CCN
Type: OSVDB ID: 52704
VMware Multiple Products Unspecified Virtual Hardware Request Memory Corruption

Source: BUGTRAQ
Type: Third Party Advisory, VDB Entry
20081203 VMSA-2008-0019 VMware Hosted products and patches for ESX and ESXi resolve a critical security issue and update bzip2

Source: BUGTRAQ
Type: Third Party Advisory, VDB Entry
20081203 Re: VMSA-2008-0019 VMware Hosted products and patches for ESX and ESXi resolve a critical security issue and update bzip2

Source: BID
Type: Third Party Advisory, VDB Entry
32597

Source: CCN
Type: BID-32597
VMware Products Unspecified Host Memory Corruption Vulnerability

Source: XF
Type: UNKNOWN
vmware-machine-security-bypass(47017)

Source: OVAL
Type: Third Party Advisory
oval:org.mitre.oval:def:6246

Vulnerable Configuration:

Configuration 1:

cpe:/a:vmware:esx:*:*:*:*:*:*:*:* (Version >= 3.0.2 and <= 3.5)

OR cpe:/a:vmware:esxi:3.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:player:*:*:*:*:*:*:*:* (Version >= 1.0.0 and <= 1.0.8)

OR cpe:/a:vmware:player:*:*:*:*:*:*:*:* (Version >= 2.0 and <= 2.0.5)

OR cpe:/a:vmware:server:*:*:*:*:*:*:*:* (Version >= 1.0 and <= 1.0.9)

OR cpe:/a:vmware:workstation:*:*:*:*:*:*:*:* (Version >= 5.5 and <= 5.5.8)

OR cpe:/a:vmware:workstation:*:*:*:*:*:*:*:* (Version >= 6.0 and <= 6.0.5)

Configuration CCN 1:

cpe:/a:vmware:workstation:5.5.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:esx_server:2.5.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:2.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:*:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:1.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:1.0.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:5.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:5.5.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:5.5.4:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:2.0.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:esx_server:3.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:1.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:5.5.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:5.5.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:5.5.6:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.0.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.0.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.0.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:1.0.4:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:1.0.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:1.0.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:1.0.4:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:1.0.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:5.5.8:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:1.0.7:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:1.0.7:*:*:*:*:*:*:*

OR cpe:/a:vmware:esx_server:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:1.0.6:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:5.5.7:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.0.4:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:1.0.6:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:2.0.4:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.0.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:5:*:*:*:*:*:*:*

OR cpe:/a:vmware:ace:2.0.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:1.0.8:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.mitre.oval:def:6246	V	VMware ESX Virtual Hardware Memory Access Bug Lets Local Users Gain Elevated Privileges	2010-05-17