CVE-2007-5671

CWE-20 — Improper Input Validation3 documents3 sources
Severity
4.4MEDIUM
EPSS
0.1%
top 69.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Vmware ACEVmware ESXVmware ESX Server+6 more
Timeline
PublishedJun 5
Latest updateMay 1

Description

HGFS.sys in the VMware Tools package in VMware Workstation 5.x before 5.5.6 build 80404, VMware Player before 1.0.6 build 80404, VMware ACE before 1.0.5 build 79846, VMware Server before 1.0.5 build 80187, and VMware ESX 2.5.4 through 3.0.2 does not properly validate arguments in user-mode METHOD_NEITHER IOCTLs to the \\.\hgfs device, which allows guest OS users to modify arbitrary memory locations in guest kernel memory and gain privileges.

CVSS vector

AV:L/AC:M/C:P/I:P/A:PExploitability: 3.4 | Impact: 6.4

Affected Packages9 packages

▶NVDvmware/player1.0.4
▶NVDvmware/server1.0.3
▶NVDvmware/workstation5.5.1, 5.5.3, 5.5.4+2
▶NVDvmware/vmware_player5 versions+4

🔴Vulnerability Details

2
GHSA
GHSA-rcvp-7793-9q23: HGFS↗2022-05-01
▶
CVEList
CVE-2007-5671: HGFS↗2008-06-05
▶
CVE-2007-5671 (MEDIUM CVSS 4.4) | HGFS.sys in the VMware Tools packag | cvebase.io