Vulnerability Name:

CVE-2009-0908 (CCN-49705)

Assigned:2009-04-03
Published:2009-04-03
Updated:2017-09-29
Summary:Unspecified vulnerability in the ACE shared folders implementation in the VMware Host Guest File System (HGFS) shared folders feature in VMware ACE 2.5.1 and earlier allows attackers to enable a disabled shared folder.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:6.4 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N)
4.7 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N)
1.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2009-0908

Source: MLIST
Type: Patch, Vendor Advisory
[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues

Source: FULLDISC
Type: Patch
20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues

Source: CCN
Type: SECTRACK ID: 1021975
VMware Host Guest File System Bug Lets Local Users Enable Certain Shared Folders

Source: CCN
Type: OSVDB ID: 56409
VMware ACE Host Guest File System (HGFS) Disabled Folder Restriction Bypass

Source: BID
Type: UNKNOWN
34373

Source: CCN
Type: BID-34373
VMware Hosted Products VMSA-2009-0005 Multiple Remote Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1021975

Source: CCN
Type: VMSA-2009-0005
VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues

Source: CONFIRM
Type: UNKNOWN
http://www.vmware.com/security/advisories/VMSA-2009-0005.html

Source: VUPEN
Type: UNKNOWN
ADV-2009-0944

Source: XF
Type: UNKNOWN
vmware-hgfs-unauth-access(49705)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6399

Vulnerable Configuration:Configuration 1:
  • cpe:/a:vmware:ace:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.5.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:*:*:*:*:*:*:*:* (Version <= 2.5.1)

    • Configuration CCN 1:
  • cpe:/a:vmware:ace:2.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.6:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:1.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:vmware:ace:2.5.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:6399
    V
    		VMware Host Guest File System Bug Lets Local Users Enable Certain Shared Folders
    2009-11-09
    BACK
    vmware ace 1.0
    vmware ace 1.0.0
    vmware ace 1.0.1
    vmware ace 1.0.2
    vmware ace 1.0.3
    vmware ace 1.0.4
    vmware ace 1.0.5
    vmware ace 1.0.6
    vmware ace 1.0.7
    vmware ace 2.0
    vmware ace 2.0.1
    vmware ace 2.0.2
    vmware ace 2.0.3
    vmware ace 2.0.4
    vmware ace 2.0.5
    vmware ace 2.5.0
    vmware ace *
    vmware ace 2.0
    vmware ace 1.0
    vmware ace 1.0.3
    vmware ace 2.0.3
    vmware ace 2.0.1
    vmware ace 2.0.2
    vmware ace 1.0.1
    vmware ace 1.0.2
    vmware ace 1.0.4
    vmware ace 1.0.5
    vmware ace 1.0.7
    vmware ace 1.0.6
    vmware ace 2.0.4
    vmware ace 2.0.5
    vmware ace 2.5.1
    vmware ace 1.0.0
    vmware ace 2.5.0