Executive Summary
This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
| Informations | |||
|---|---|---|---|
| Name | CVE-2010-1139 | First vendor Publication | 2010-04-12 |
| Vendor | Cve | Last vendor Modification | 2024-11-21 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:L/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.2 | Attack Range | Local |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 3.9 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| Format string vulnerability in vmrun in VMware VIX API 1.6.x, VMware Workstation 6.5.x before 6.5.4 build 246459, VMware Player 2.5.x before 2.5.4 build 246459, and VMware Server 2.x on Linux, and VMware Fusion 2.x before 2.0.7 build 246742, allows local users to gain privileges via format string specifiers in process metadata. |
Original Source
| Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-1139 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-134 | Uncontrolled Format String (CWE/SANS Top 25) |
CPE : Common Platform Enumeration
| Type | Description | Count |
|---|---|---|
| Application | 7 | |
| Application | 2 | |
| Application | 4 |
ExploitDB Exploits
| id | Description |
|---|---|
| 2009-10-07 | VMware Player and Workstation <= 6.5.3 'vmware-authd' Remote Denial of Ser... |
| 2010-04-12 | VMware Remote Console e.x.p build-158248 - format string vulnerability |
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-10-03 | Name : Gentoo Security Advisory GLSA 201209-25 (vmware-server vmware-player vmware-w... File : nvt/glsa_201209_25.nasl |
| 2012-04-16 | Name : VMSA-2010-0007: VMware hosted products, vCenter Server and ESX patches resolv... File : nvt/gb_VMSA-2010-0007.nasl |
| 2010-04-29 | Name : VMware Authorization Service Denial of Service Vulnerability (Win) -Apr10 File : nvt/secpod_vmware_prdts_dos_vuln_win_apr10.nasl |
| 2010-04-16 | Name : VMware Products Multiple Vulnerabilities (Windows) File : nvt/gb_vmware_prdts_mult_vuln_win01.nasl |
| 2010-04-16 | Name : VMware Products Tools Remote Code Execution Vulnerabilies (win) File : nvt/gb_vmware_prdts_tools_code_exec_vuln_lin.nasl |
| 2010-04-16 | Name : VMware Products Tools Remote Code Execution Vulnerabilies (win) File : nvt/gb_vmware_prdts_tools_code_exec_vuln_win.nasl |
| 2010-04-16 | Name : VMware Products 'vmware-vmx' Information Disclosure Vulnerability (Linux) File : nvt/gb_vmware_prdts_vmx_info_disc_vuln_lin.nasl |
| 2010-04-16 | Name : VMware Products 'vmware-vmx' Information Disclosure Vulnerability (Win) File : nvt/gb_vmware_prdts_vmx_info_disc_vuln_win.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 63606 | VMware VIX API vmrun Utility Process List Format String Local Privilege Escal... |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2010-04-15 | IAVM : 2010-A-0066 - Multiple Vulnerabilities in VMware Products Severity : Category I - VMSKEY : V0023997 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-03-08 | Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0007_remote.nasl - Type : ACT_GATHER_INFO |
| 2012-10-01 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201209-25.nasl - Type : ACT_GATHER_INFO |
| 2011-09-21 | Name : The remote VMware ESX host is missing a security-related patch. File : vmware_VMSA-2010-0007.nasl - Type : ACT_GATHER_INFO |
| 2010-04-15 | Name : The remote host has a virtualization application affected by multiple vulnera... File : vmware_multiple_vmsa_2010_0007.nasl - Type : ACT_GATHER_INFO |
Sources (Detail)
Alert History
| Date | Informations |
|---|---|
| 2024-11-28 23:08:49 |
|
| 2024-11-28 12:21:30 |
|
| 2021-05-04 12:11:16 |
|
| 2021-04-22 01:11:54 |
|
| 2020-05-23 00:25:30 |
|
| 2016-06-28 18:06:13 |
|
| 2016-04-26 19:41:34 |
|
| 2014-02-17 10:54:25 |
|
| 2013-11-11 12:38:42 |
|
| 2013-05-16 17:02:38 |
|
| 2013-05-10 23:21:17 |
|
