The host is installed with VMWare products and are prone to multiple vulnerabilities.

Successful exploitation will allow attacker to cause a heap-based buffer overflow via specially crafted video files containing incorrect framebuffer parameters. Impact Level: System/Application

Upgrade to workstation version 6.5.4 build 246459, http://www.vmware.com/products/ws/ Upgrade to VMware player version 6.5.4 build 246459, http://www.vmware.com/products/player/ Apply workaround for VMware Server version 2.x, http://www.vmware.com/resources/techresources/726 ***** NOTE: Ignore this warning, if above mentioned workaround is manually applied. *****

The multiple flaws are due to - An integer truncation errors in 'vmnc.dll' when processing 'HexTile' encoded video chunks which can be exploited to cause heap-based buffer overflows. - A format string vulnerability in 'vmrun' allows users to gain privileges via format string specifiers in process metadata.

VMware Server version 2.x, VMware Player version 2.5.x before 2.5.4 build 246459 and VMware Workstation version 6.5.x before 6.5.4 build 246459 on windows

• http://secunia.com/advisories/36712
• http://secunia.com/secunia_research/2009-36/
• http://www.securityfocus.com/archive/1/510643

---

Updated on 2015-03-25