GLSA-201209-25 : VMware Player, Server, Workstation: Multiple vulnerabilities

critical Nessus Plugin ID 62383
New! Vulnerability Priority Rating (VPR)

Tenable calculates a dynamic VPR for every vulnerability. VPR combines vulnerability information with threat intelligence and machine learning algorithms to predict which vulnerabilities are most likely to be exploited in attacks. Read more about what VPR is and how it is different from CVSS.

VPR Score: 9


The remote Gentoo host is missing one or more security-related patches.


The remote host is affected by the vulnerability described in GLSA-201209-25 (VMware Player, Server, Workstation: Multiple vulnerabilities)

Multiple vulnerabilities have been discovered in VMware Player, Server, and Workstation. Please review the CVE identifiers referenced below for details.
Impact :

Local users may be able to gain escalated privileges, cause a Denial of Service, or gain sensitive information.
A remote attacker could entice a user to open a specially crafted file, possibly resulting in the remote execution of arbitrary code, or a Denial of Service. Remote attackers also may be able to spoof DNS traffic, read arbitrary files, or inject arbitrary web script to the VMware Server Console.
Furthermore, guest OS users may be able to execute arbitrary code on the host OS, gain escalated privileges on the guest OS, or cause a Denial of Service (crash the host OS).
Workaround :

There is no known workaround at this time.


Gentoo discontinued support for VMware Player. We recommend that users unmerge VMware Player:
# emerge --unmerge 'app-emulation/vmware-player' NOTE: Users could upgrade to “>=app-emulation/vmware-player-3.1.5”, however these packages are not currently stable.
Gentoo discontinued support for VMware Workstation. We recommend that users unmerge VMware Workstation:
# emerge --unmerge 'app-emulation/vmware-workstation' NOTE: Users could upgrade to “>=app-emulation/vmware-workstation-7.1.5”, however these packages are not currently stable.
Gentoo discontinued support for VMware Server. We recommend that users unmerge VMware Server:
# emerge --unmerge 'app-emulation/vmware-server'

See Also

Plugin Details

Severity: Critical

ID: 62383

File Name: gentoo_GLSA-201209-25.nasl

Version: 1.26

Type: local

Published: 10/1/2012

Updated: 1/6/2021

Dependencies: ssh_get_info.nasl

Risk Information

Risk Factor: Critical

VPR Score: 9

CVSS v2.0

Base Score: 10

Temporal Score: 8.3

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: E:F/RL:OF/RC:C

CVSS v3.0

Base Score: 6.8

Temporal Score: 6.3

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N

Temporal Vector: E:F/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:gentoo:linux:vmware-player, p-cpe:/a:gentoo:linux:vmware-server, p-cpe:/a:gentoo:linux:vmware-workstation, cpe:/o:gentoo:linux

Required KB Items: Host/local_checks_enabled, Host/Gentoo/release, Host/Gentoo/qpkg-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 9/29/2012

Vulnerability Publication Date: 10/8/2007

Exploitable With

CANVAS (D2ExploitPack)

Core Impact

Elliot (Vmware Server File Disclosure)

ExploitHub (EH-14-757)

Reference Information

CVE: CVE-2007-5269, CVE-2007-5503, CVE-2007-5671, CVE-2008-0967, CVE-2008-1340, CVE-2008-1361, CVE-2008-1362, CVE-2008-1363, CVE-2008-1364, CVE-2008-1392, CVE-2008-1447, CVE-2008-1806, CVE-2008-1807, CVE-2008-1808, CVE-2008-2098, CVE-2008-2100, CVE-2008-2101, CVE-2008-4915, CVE-2008-4916, CVE-2008-4917, CVE-2009-0040, CVE-2009-0909, CVE-2009-0910, CVE-2009-1244, CVE-2009-2267, CVE-2009-3707, CVE-2009-3732, CVE-2009-3733, CVE-2009-4811, CVE-2010-1137, CVE-2010-1138, CVE-2010-1139, CVE-2010-1140, CVE-2010-1141, CVE-2010-1142, CVE-2010-1143, CVE-2011-3868

BID: 25956, 26650, 28276, 28289, 29444, 29552, 29557, 29637, 29639, 29640, 29641, 30131, 30937, 32168, 32597, 33827, 33990, 34373, 34471, 36630, 36841, 36842, 39104, 39392, 39394, 39395, 39396, 39397, 39407, 39949, 49942

GLSA: 201209-25

IAVA: 2008-A-0045

CWE: 16, 20, 22, 94, 119, 134, 189, 200, 264, 399