CVE-2013-1406
published 2013-02-11CVE-2013-1406: The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware…
PriorityP434high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
0.97%
61.5th percentile
The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware Fusion 4.1 before 4.1.4 and 5.0 before 5.0.2, VMware View 4.x before 4.6.2 and 5.x before 5.1.2 on Windows, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 does not properly restrict memory allocation by control code, which allows local users to gain privileges via unspecified vectors.
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | view | — | — |
| vmware | view | — | — |
| vmware | view | — | — |
| vmware | view | — | — |
| vmware | view | — | — |
| vmware | view | — | — |
| vmware | view | — | — |
| vmware | view | — | — |
| vmware | view | — | — |
| vmware | vmware_esxi | — | — |
| vmware | vmware_fusion | — | — |
| vmware | vmware_vcenter_server | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hqcr-m2wp-rwvf: The Virtual Machine Communication Interface (VMCI) implementation in vmci
ghsa_unreviewed·2022-05-17
CVE-2013-1406 [HIGH] CWE-20 GHSA-hqcr-m2wp-rwvf: The Virtual Machine Communication Interface (VMCI) implementation in vmci
The Virtual Machine Communication Interface (VMCI) implementation in vmci.sys in VMware Workstation 8.x before 8.0.5 and 9.x before 9.0.1 on Windows, VMware Fusion 4.1 before 4.1.4 and 5.0 before 5.0.2, VMware View 4.x before 4.6.2 and 5.x before 5.1.2 on Windows, VMware ESXi 4.0 through 5.1, and VMware ESX 4.0 and 4.1 does not properly restrict memory allocation by control code, which allows local users to gain privileges via unspecified vectors.
VMware
VMware ESX, Workstation, Fusion, and View VMCI privilege escalation vulnerability
vendor_vmware·2013-02-07·CVSS 7.2
CVE-2012-2110 [HIGH] VMware ESX, Workstation, Fusion, and View VMCI privilege escalation vulnerability
VMSA-2013-0002: VMware ESX, Workstation, Fusion, and View VMCI privilege escalation vulnerability
a. VMware VMCI privilege escalation VMware ESX, Workstation, Fusion, and View contain a vulnerability in the handling of control code in vmci.sys. A local malicious user may exploit this vulnerability to manipulate the memory allocation through the Virtual Machine Communication Interface (VMCI) code. This could result in a privilege escalation on Windows-based hosts and on Windows-based Guest Operating Systems. The vulnerability does not allow for privilege escalation from the Guest Operating System to the host (and vice versa). This means that host memory can not be manipulated from the Guest Operating System (and vice versa). Systems that have VMCI disabled are also affected by this issue.
VMware
VMware vSphere security updates for the authentication service and third party libraries
vendor_vmware·2013-01-31·CVSS 10.0
CVE-2011-1202 [CRITICAL] VMware vSphere security updates for the authentication service and third party libraries
VMSA-2013-0001: VMware vSphere security updates for the authentication service and third party libraries
a. VMware vSphere client-side authentication memory corruption vulnerability VMware vCenter Server, vSphere Client, and ESX contain a vulnerability in the handling of the management authentication protocol. To exploit this vulnerability, an attacker must convince either vCenter Server, vSphere Client or ESX to interact with a malicious server as a client. Exploitation of the issue may lead to code execution on the client system. To reduce the likelihood of exploitation, vSphere components should be deployed on an isolated management network. The Common Vulnerabilities and Exposures Project (cve.mitre.org) has assigned the name CVE-2013-1405 to this issue. Column 4 of the following tabl
No detection rules found.
No writeups or analysis indexed.
http://www.vmware.com/security/advisories/VMSA-2013-0002.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17164http://www.vmware.com/security/advisories/VMSA-2013-0002.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17164
2013-02-11
Published