CVE-2008-0923: Path Traversal

Published Feb 26, 2008

Updated

Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character string containing .. (dot dot) sequences, which bypasses the protection mechanism, as demonstrated using a "%c0%2e%c0%2e" string.

Affected Software

15 affected components

VMware VMware Player=1.0.3

VMware ACE=1.0

VMware VMware Player=1.0.2

VMware ACE=2.0.2

VMware ACE=2.0

VMware ACE=2.0.1

VMware ACE=1.0.2

VMware Workstation=6.0

VMware Workstation=5.5.3_build_34685

VMware VMware Player=1.0.1_build_19317

VMware Player=1.0.4

VMware VMware Workstation=6.0.2

VMware VMware Workstation=6.0.1

VMware Workstation=5.5.4

VMware Workstation=4.5.2

Event History

Feb 26, 2008

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0923?

CVE-2008-0923 has a moderate severity rating due to its ability to allow guest OS users to access arbitrary files on the host OS.

How do I fix CVE-2008-0923?

To fix CVE-2008-0923, users should upgrade to the latest versions of affected VMware products that include the necessary patches.

What versions of VMware are affected by CVE-2008-0923?

CVE-2008-0923 affects VMware ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2.

What is a directory traversal vulnerability in CVE-2008-0923?

A directory traversal vulnerability in CVE-2008-0923 allows unauthorized access to files on the host OS by manipulating file paths.

Can CVE-2008-0923 be exploited remotely?

CVE-2008-0923 can be exploited by a user on the guest OS to access sensitive data on the host OS, highlighting its security risk.