CVEvulnerability

CVE-2007-5671

4.4 MEDIUM Published 2008-06-05 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-06-05
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.4 MEDIUM — AV:L/AC:M/Au:N/C:P/I:P/A:P
Weaknesses
CWE-20

Description

HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \\.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.

Affected configurations

• vmware ace 1.0.0 • vmware ace 1.0.1 • vmware ace 1.0.2 • vmware ace 1.0.3 • vmware ace 1.0.4 • vmware esx server 2.5.5 • vmware player 1.0.4 • vmware server 1.0.3 • vmware vmware player 1.0.0 • vmware vmware player 1.0.1 • vmware vmware player 1.0.2 • vmware vmware player 1.0.3 • vmware vmware player 1.0.5 • vmware vmware server 1.0.0 • vmware vmware server 1.0.1 • vmware vmware server 1.0.2 • vmware vmware server 1.0.4 • vmware vmware workstation 5.5.0 • vmware vmware workstation 5.5.2 • vmware vmware workstation 5.5.5 • vmware workstation 5.5.1 • vmware workstation 5.5.3 • vmware workstation 5.5.4 • vmware esx 2.5.4 • vmware esx 3.0.0 • vmware esx 3.0.1 • vmware esx 3.0.2

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References