Test ID:	1.3.6.1.4.1.25623.1.0.902173
Category:	Denial of Service
Title:	VMware Authorization Service DoS Vulnerability (VMSA-2010-0007) - Windows
Summary:	VMWare product(s) are prone to a denial of service (DoS) vulnerability.
Description:	Summary: VMWare product(s) are prone to a denial of service (DoS) vulnerability. Vulnerability Insight: The vulnerability is due to an error in the VMware Authorization Service when processing login requests. This can be exploited to terminate the 'vmware-authd' process via 'USER' or 'PASS' strings containing '\xFF' characters, sent to TCP port 912. Vulnerability Impact: Successful exploitation allows attackers to execute arbitrary code on the affected application and causes the Denial of Service. Affected Software/OS: VMware Server 2.x VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459 VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459 VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459 Solution: Upgrade to player 3.0.1 build 227600 or 2.5.4 build 246459, Upgrade to VMware ACE 2.6.1 build 227600 or 2.5.4 build 246459 Upgrade VMware Workstation 7.0.1 build 227600 and 6.5.4 build 246459 Apply the workaround for VMware Server version 2.x described in the referenced techresource. CVSS Score: 5.0 CVSS Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-4811 BugTraq ID: 36630 http://www.securityfocus.com/bid/36630 Bugtraq: 20100409 VMSA-2010-0007 VMware hosted products, vCenter Server and ESX patches resolve multiple security issues (Google Search) http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html http://security.gentoo.org/glsa/glsa-201209-25.xml http://freetexthost.com/qr1tffkzpu http://pocoftheday.blogspot.com/2009/10/vmware-server-20x-remote-dos-exploit.html http://www.vmware.com/security/advisories/VMSA-2010-0007.html http://lists.vmware.com/pipermail/security-announce/2010/000090.html
Copyright	Copyright (C) 2010 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.