Vulnerability CVE-2009-1565 - CERT Civis.Net

Vulnerability Name:

CVE-2009-1565 (CCN-57667)

Assigned:

2009-05-06

Published:

2010-04-09

Updated:

2010-04-22

Summary:

vmnc.dll in the VMnc media codec in VMware Movie Decoder before 6.5.4 Build 246459 on Windows, and the movie decoder in VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Windows, allows remote attackers to execute arbitrary code via an AVI file with crafted HexTile-encoded video chunks that trigger heap-based buffer overflows, related to "integer truncation errors."

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C)
6.9 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

6.8 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P)
5.0 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Access

References:

Source: BUGTRAQ
Type: UNKNOWN
20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues

Source: FULLDISC
Type: UNKNOWN
20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues

Source: MITRE
Type: CNA
CVE-2009-1565

Source: CCN
Type: VMSA-2010-0007
VMware hosted products, vCenter Server and ESX patches resolve multiple security issues

Source: MLIST
Type: Patch
[security-announce] 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues

Source: CCN
Type: SA36712
VMware Workstation Movie Decoder VMnc Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
36712

Source: CCN
Type: SA39206
VMware Products Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
39206

Source: CCN
Type: SA39215
VMware Server Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
39215

Source: MISC
Type: Vendor Advisory
http://secunia.com/secunia_research/2009-37/

Source: CCN
Type: SECTRACK ID: 1023838
VMware Heap Overflows in VMnc Codec Let Remote Users Cause Arbitrary Code to Be Executed

Source: OSVDB
Type: UNKNOWN
63615

Source: CCN
Type: OSVDB ID: 63615
VMware Workstation vmnc.dll Hextile Encoded AVI Handling Multiple Integer Truncation Overflow

Source: CCN
Type: BID-39345
RETIRED: VMware Hosted Products VMSA-2010-0007 Multiple Remote and Local Vulnerabilities

Source: BID
Type: UNKNOWN
39364

Source: CCN
Type: BID-39364
VMware Hosted Products Integer Truncation Multiple Heap Buffer Overflow Vulnerabilities

Source: SECTRACK
Type: UNKNOWN
1023838

Source: CONFIRM
Type: Patch
http://www.vmware.com/security/advisories/VMSA-2010-0007.html

Source: XF
Type: UNKNOWN
vmware-hextile-bo(57667)

Vulnerable Configuration:

Configuration 1:

cpe:/a:vmware:movie_decoder:6.5.3:*:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows:*:*:*:*:*:*:*:*

Configuration 2:

cpe:/a:vmware:workstation:6.5.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.5.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.5.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.5.3:*:*:*:*:*:*:*

Configuration 3:

cpe:/a:vmware:player:2.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:player:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:player:2.5.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:player:2.5.3:*:*:*:*:*:*:*

Configuration 4:

cpe:/a:vmware:server:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:2.0.2:*:*:*:*:*:*:*

AND

cpe:/o:microsoft:windows:*:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:vmware:workstation:6.5.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.5.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.5.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:movie_decoder:6.5.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:player:2.5.2:*:*:*:*:*:*:*

OR cpe:/a:vmware:player:2.5.3:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:2.0.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:player:2.5:*:*:*:*:*:*:*

OR cpe:/a:vmware:player:2.5.1:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:2.0.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:workstation:6.5.0:*:*:*:*:*:*:*

OR cpe:/a:vmware:server:2.0.2:*:*:*:*:*:*:*

Denotes that component is vulnerable