CVE-2008-3892

published 2008-09-03

CVE-2008-3892: Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build…

Priority P3 55 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

Buffer overflow in a certain ActiveX control in the COM API in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 allows remote attackers to cause a denial of service (browser crash) or possibly execute arbitrary code via a call to the GuestInfo method in which there is a long string argument, and an assignment of a long string value to the result of this call. NOTE: this may overlap CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
vmware	ace	>= 1.0 < 1.0.7	1.0.7
vmware	ace	>= 2.0 < 2.0.5	2.0.5
vmware	player	>= 1.0.0 < 1.0.8	1.0.8
vmware	player	>= 2.0 < 2.0.5	2.0.5
vmware	server	< 1.0.7	1.0.7
vmware	workstation	>= 5.5 < 5.5.8	5.5.8
vmware	workstation	>= 6.0 < 6.0.5	6.0.5

Detection & IOCs extracted from sources · hover to see the quote

command test.GuestInfo (buff_1) = buff_2↗

bytes↗

8B 51 70 8B 02 5D C3 90 90 90 90 90 90 90 90 90

• → Buffer overflow triggered by calling the GuestInfo ActiveX method with a long string argument (~2000 chars of 'a') and assigning a long string value (~2000 chars of 'b') to the result of that call via the VMware COM API ActiveX control in a browser context. ↗
• → Exploit is delivered via Internet Explorer (browser-based attack surface); the VMware COM API ActiveX control is instantiated in-browser and the GuestInfo method is called from script (e.g., VBScript). ↗

• · Affected versions span multiple VMware products; patched builds are: VMware Workstation 5.5.x build 108000, Workstation 6.0.x build 109488, Player 1.x build 108000, Player 2.x build 109488, ACE 1.x build 108880, ACE 2.x build 109488, Server build 108231. ↗
• · This CVE may overlap with CVE-2008-3691, CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, or CVE-2008-3696 — deduplication against those CVEs is advised before deploying detections. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119