CVE-2008-3761 - Vulnerability Details - OpenCVE

hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Complete

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Vmware	Vmware Workstation

Configuration 1 [-]

cpe:2.3:a:vmware:vmware_workstation:6.0.0.45731:*:*:*:*:*:*:*

No data.

References

Link	Providers
http://lists.vmware.com/pipermail/security-announce/2009/000054.html
http://seclists.org/fulldisclosure/2009/Apr/0036.html
http://securityreason.com/securityalert/4177
http://www.orange-bat.com/adv/2008/adv.08.17.txt
http://www.securityfocus.com/bid/30737
http://www.securityfocus.com/bid/34373
http://www.securitytracker.com/id?1020715
http://www.vmware.com/security/advisories/VMSA-2009-0005.html
http://www.vupen.com/english/advisories/2009/0944
https://exchange.xforce.ibmcloud.com/vulnerabilities/44539
https://www.exploit-db.com/exploits/6262

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2008-08-21T17:00:00

Updated: 2024-08-07T09:53:00.346Z

Reserved: 2008-08-21T00:00:00

Link: CVE-2008-3761

Vulnrichment

No data.

NVD

Status : Modified

Published: 2008-08-21T17:41:00.000

Modified: 2024-11-21T00:50:03.897

Link: CVE-2008-3761

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2008-08-17T00:00:00", "descriptions": [{"lang": "en", "value": "hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-09-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"name": "vmware-workstation-hcmon-dos(44539)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44539"}, {"name": "4177", "tags": ["third-party-advisory", "x_refsource_SREASON"], "url": "http://securityreason.com/securityalert/4177"}, {"name": "20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues", "tags": ["mailing-list", "x_refsource_FULLDISC"], "url": "http://seclists.org/fulldisclosure/2009/Apr/0036.html"}, {"name": "30737", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/30737"}, {"name": "34373", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/34373"}, {"name": "1020715", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id?1020715"}, {"tags": ["x_refsource_MISC"], "url": "http://www.orange-bat.com/adv/2008/adv.08.17.txt"}, {"name": "ADV-2009-0944", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2009/0944"}, {"name": "[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://lists.vmware.com/pipermail/security-announce/2009/000054.html"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html"}, {"name": "6262", "tags": ["exploit", "x_refsource_EXPLOIT-DB"], "url": "https://www.exploit-db.com/exploits/6262"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2008-3761", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "vmware-workstation-hcmon-dos(44539)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44539"}, {"name": "4177", "refsource": "SREASON", "url": "http://securityreason.com/securityalert/4177"}, {"name": "20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues", "refsource": "FULLDISC", "url": "http://seclists.org/fulldisclosure/2009/Apr/0036.html"}, {"name": "30737", "refsource": "BID", "url": "http://www.securityfocus.com/bid/30737"}, {"name": "34373", "refsource": "BID", "url": "http://www.securityfocus.com/bid/34373"}, {"name": "1020715", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id?1020715"}, {"name": "http://www.orange-bat.com/adv/2008/adv.08.17.txt", "refsource": "MISC", "url": "http://www.orange-bat.com/adv/2008/adv.08.17.txt"}, {"name": "ADV-2009-0944", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2009/0944"}, {"name": "[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues", "refsource": "MLIST", "url": "http://lists.vmware.com/pipermail/security-announce/2009/000054.html"}, {"name": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html", "refsource": "CONFIRM", "url": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html"}, {"name": "6262", "refsource": "EXPLOIT-DB", "url": "https://www.exploit-db.com/exploits/6262"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T09:53:00.346Z"}, "title": "CVE Program Container", "references": [{"name": "vmware-workstation-hcmon-dos(44539)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44539"}, {"name": "4177", "tags": ["third-party-advisory", "x_refsource_SREASON", "x_transferred"], "url": "http://securityreason.com/securityalert/4177"}, {"name": "20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues", "tags": ["mailing-list", "x_refsource_FULLDISC", "x_transferred"], "url": "http://seclists.org/fulldisclosure/2009/Apr/0036.html"}, {"name": "30737", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/30737"}, {"name": "34373", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/34373"}, {"name": "1020715", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id?1020715"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://www.orange-bat.com/adv/2008/adv.08.17.txt"}, {"name": "ADV-2009-0944", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2009/0944"}, {"name": "[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://lists.vmware.com/pipermail/security-announce/2009/000054.html"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html"}, {"name": "6262", "tags": ["exploit", "x_refsource_EXPLOIT-DB", "x_transferred"], "url": "https://www.exploit-db.com/exploits/6262"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2008-3761", "datePublished": "2008-08-21T17:00:00", "dateReserved": "2008-08-21T00:00:00", "dateUpdated": "2024-08-07T09:53:00.346Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:vmware:vmware_workstation:6.0.0.45731:*:*:*:*:*:*:*", "matchCriteriaId": "9F01ABD8-5C77-422E-849C-E7460072DB0B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request."}, {"lang": "es", "value": "hcmon.sys en VMware Workstation 6.0.0.45731 utiliza el m\u00e9todo de comunicaci\u00f3n METHOD_NEITHER para IOCTLs, lo cual tiene un impacto desconocido (posiblemente ca\u00edda) y vectores de ataque locales a trav\u00e9s de una petici\u00f3n IOCTL manipulada."}], "id": "CVE-2008-3761", "lastModified": "2024-11-21T00:50:03.897", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 4.9, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:C", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2008-08-21T17:41:00.000", "references": [{"source": "cve@mitre.org", "url": "http://lists.vmware.com/pipermail/security-announce/2009/000054.html"}, {"source": "cve@mitre.org", "url": "http://seclists.org/fulldisclosure/2009/Apr/0036.html"}, {"source": "cve@mitre.org", "url": "http://securityreason.com/securityalert/4177"}, {"source": "cve@mitre.org", "url": "http://www.orange-bat.com/adv/2008/adv.08.17.txt"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/30737"}, {"source": "cve@mitre.org", "url": "http://www.securityfocus.com/bid/34373"}, {"source": "cve@mitre.org", "url": "http://www.securitytracker.com/id?1020715"}, {"source": "cve@mitre.org", "url": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html"}, {"source": "cve@mitre.org", "url": "http://www.vupen.com/english/advisories/2009/0944"}, {"source": "cve@mitre.org", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44539"}, {"source": "cve@mitre.org", "url": "https://www.exploit-db.com/exploits/6262"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://lists.vmware.com/pipermail/security-announce/2009/000054.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://seclists.org/fulldisclosure/2009/Apr/0036.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://securityreason.com/securityalert/4177"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.orange-bat.com/adv/2008/adv.08.17.txt"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/30737"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/34373"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securitytracker.com/id?1020715"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.vupen.com/english/advisories/2009/0944"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44539"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.exploit-db.com/exploits/6262"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}