CVEvulnerability

CVE-2008-0923

6.9 MEDIUM Published 2008-02-26 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2008-02-26
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.9 MEDIUM — AV:L/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-22

Description

Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character string containing .. (dot dot) sequences, which bypasses the protection mechanism, as demonstrated using a "%c0%2e%c0%2e" string.

Affected configurations

• vmware ace 1.0 • vmware ace 1.0.2 • vmware ace 2.0 • vmware ace 2.0.1 • vmware ace 2.0.2 • vmware player 1.0.4 • vmware vmware player 1.0.1 build 19317 • vmware vmware player 1.0.2 • vmware vmware player 1.0.3 • vmware vmware workstation 6.0.1 • vmware vmware workstation 6.0.2 • vmware workstation 4.5.2 • vmware workstation 5.5.3 build 34685 • vmware workstation 5.5.4 • vmware workstation 6.0

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References