CVE-2008-3892
Description
Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a call to the GuestInfo method in which there is a long string argument, and an assignment of a long string value to the result of this call. NOTE: this may overlap CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696.
How to fix
- vmware player1.0.8, 2.0.5 or later
- vmware ace1.0.7, 2.0.5 or later
- vmware server1.0.7 or later
- vmware workstation5.5.8, 6.0.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware player | 1.0.0 ≤ v < 1.0.8, 2.0 ≤ v < 2.0.5 | 1.0.8, 2.0.5 |
| vmware ace | 1.0 ≤ v < 1.0.7, 2.0 ≤ v < 2.0.5 | 1.0.7, 2.0.5 |
| vmware server | v < 1.0.7 | 1.0.7 |
| vmware workstation | 5.5 ≤ v < 5.5.8, 6.0 ≤ v < 6.0.5 | 5.5.8, 6.0.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.