CVE-2007-0063

Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html	Third Party Advisory
http://secunia.com/advisories/26890	Third Party Advisory
http://secunia.com/advisories/27694	Third Party Advisory
http://secunia.com/advisories/27706	Third Party Advisory
http://security.gentoo.org/glsa/glsa-200711-23.xml	Third Party Advisory
http://www.iss.net/threats/275.html	Patch Third Party Advisory
http://www.securityfocus.com/bid/25729	Patch Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1018717	Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/usn-543-1	Third Party Advisory
http://www.vmware.com/support/ace/doc/releasenotes_ace.html	Patch Vendor Advisory
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html	Patch Vendor Advisory
http://www.vmware.com/support/player/doc/releasenotes_player.html	Patch Vendor Advisory
http://www.vmware.com/support/player2/doc/releasenotes_player2.html	Patch Vendor Advisory
http://www.vmware.com/support/server/doc/releasenotes_server.html	Patch Vendor Advisory
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html	Patch Vendor Advisory
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html	Patch Vendor Advisory
http://www.vupen.com/english/advisories/2007/3229	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/33103	Third Party Advisory VDB Entry
http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html	Third Party Advisory
http://secunia.com/advisories/26890	Third Party Advisory
http://secunia.com/advisories/27694	Third Party Advisory
http://secunia.com/advisories/27706	Third Party Advisory
http://security.gentoo.org/glsa/glsa-200711-23.xml	Third Party Advisory
http://www.iss.net/threats/275.html	Patch Third Party Advisory
http://www.securityfocus.com/bid/25729	Patch Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1018717	Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/usn-543-1	Third Party Advisory
http://www.vmware.com/support/ace/doc/releasenotes_ace.html	Patch Vendor Advisory
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html	Patch Vendor Advisory
http://www.vmware.com/support/player/doc/releasenotes_player.html	Patch Vendor Advisory
http://www.vmware.com/support/player2/doc/releasenotes_player2.html	Patch Vendor Advisory
http://www.vmware.com/support/server/doc/releasenotes_server.html	Patch Vendor Advisory
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html	Patch Vendor Advisory
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html	Patch Vendor Advisory
http://www.vupen.com/english/advisories/2007/3229	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/33103	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:vmware:ace::::::::
	cpe:2.3:a:vmware:ace::::::::
	cpe:2.3:a:vmware:player::::::::
	cpe:2.3:a:vmware:player::::::::
	cpe:2.3:a:vmware:server::::::::
	cpe:2.3:a:vmware:workstation::::::::
	cpe:2.3:a:vmware:workstation::::::::
	cpe:2.3:o:vmware:esx:2.0.2:::::::*
	cpe:2.3:o:vmware:esx:2.1.3:::::::*
	cpe:2.3:o:vmware:esx:2.5.3:::::::*
	cpe:2.3:o:vmware:esx:2.5.4:::::::*
	cpe:2.3:o:vmware:esx:3.0.0:::::::*
	cpe:2.3:o:vmware:esx:3.0.1:::::::*

Configuration 2 (hide)

OR	cpe:2.3:o:canonical:ubuntu_linux:6.06::::lts:::
	cpe:2.3:o:canonical:ubuntu_linux:6.10:::::::*
	cpe:2.3:o:canonical:ubuntu_linux:7.04:::::::*

History

21 Nov 2024, 00:24

Information

Published : 2007-09-21 19:17

Updated : 2024-11-21 00:24

NVD link : CVE-2007-0063

Mitre link : CVE-2007-0063

CVE.ORG link : CVE-2007-0063

JSON object : View

Products Affected

vmware

esx
server
workstation
player
ace

canonical

ubuntu_linux

CWE

CWE-191

Integer Underflow (Wrap or Wraparound)

{"id": "CVE-2007-0063", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-09-21T19:17:00.000", "references": [{"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/26890", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/27694", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/27706", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://security.gentoo.org/glsa/glsa-200711-23.xml", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.iss.net/threats/275.html", "tags": ["Patch", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/25729", "tags": ["Patch", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.securitytracker.com/id?1018717", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://www.ubuntu.com/usn/usn-543-1", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vmware.com/support/ace/doc/releasenotes_ace.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vmware.com/support/player/doc/releasenotes_player.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vmware.com/support/player2/doc/releasenotes_player2.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vmware.com/support/server/doc/releasenotes_server.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/3229", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33103", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}, {"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-September/065902.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/26890", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/27694", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/27706", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://security.gentoo.org/glsa/glsa-200711-23.xml", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.iss.net/threats/275.html", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/25729", "tags": ["Patch", "Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id?1018717", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.ubuntu.com/usn/usn-543-1", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vmware.com/support/ace/doc/releasenotes_ace.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vmware.com/support/player/doc/releasenotes_player.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vmware.com/support/player2/doc/releasenotes_player2.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vmware.com/support/server/doc/releasenotes_server.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html", "tags": ["Patch", "Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.vupen.com/english/advisories/2007/3229", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33103", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-191"}]}], "descriptions": [{"lang": "en", "value": "Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow."}, {"lang": "es", "value": "Desbordamiento inferior de entero en el servidor DHCP de EMC VMware Workstation anterior a 5.5.5 Build 56455 y 5.x anterior a 6.0.1 Build 55017, Player anterior a 1.0.5 Build 56455 y Player 2 anterior a 2.0.1 Build 55017, ACE anterior a 1.0.3 Build 54075 y ACE 2 anterior a 2.0.1 Build 55017, y Server anterior a 1.0.4 Build 56527 permite a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n mediante un paquete DHCP mal formado que dispara un desbordamiento de b\u00fafer basado en pila."}], "lastModified": "2024-11-21T00:24:53.060", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:vmware:ace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9BE329FB-74A5-4D8C-B5D5-C6063CAAB479", "versionEndExcluding": "1.0.3", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:vmware:ace:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "310A0A72-A709-407D-A68D-24EF59EEC553", "versionEndExcluding": "2.0.1", "versionStartIncluding": "2.0"}, {"criteria": "cpe:2.3:a:vmware:player:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B87BD440-71B2-4D1C-B22A-A661D01928C0", "versionEndExcluding": "1.0.5", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:vmware:player:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35A00737-2932-4877-8E02-1F9534C6FBAE", "versionEndExcluding": "2.0.1", "versionStartIncluding": "2.0"}, {"criteria": "cpe:2.3:a:vmware:server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02269212-A8EE-4BB2-8C6E-122953AAFB83", "versionEndExcluding": "1.0.4", "versionStartIncluding": "1.0"}, {"criteria": "cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "27920879-1408-4514-BA3F-B31DD69FACA2", "versionEndExcluding": "5.5.5", "versionStartIncluding": "5.5"}, {"criteria": "cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1ACA1016-EAC5-4210-ABDC-C2499F2841EA", "versionEndExcluding": "6.0.1", "versionStartIncluding": "6.0"}, {"criteria": "cpe:2.3:o:vmware:esx:2.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "796BEFD3-F30A-4397-BC3E-1156DE47CA4C"}, {"criteria": "cpe:2.3:o:vmware:esx:2.1.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1F9F768C-5549-4498-8C5D-13BC5046B721"}, {"criteria": "cpe:2.3:o:vmware:esx:2.5.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "01BB3005-A185-4701-945E-8E14A23A016F"}, {"criteria": "cpe:2.3:o:vmware:esx:2.5.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C1BA6DF4-4D53-482A-8820-B9B0E6EBD51D"}, {"criteria": "cpe:2.3:o:vmware:esx:3.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "974D84A6-F5AB-4F0A-B9B5-9095A0E4733C"}, {"criteria": "cpe:2.3:o:vmware:esx:3.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C3613B7-CA1B-4C9A-9076-A2894202DDA4"}], "operator": "OR"}]}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "5C18C3CD-969B-4AA3-AE3A-BA4A188F8BFF"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:6.10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "23E304C9-F780-4358-A58D-1E4C93977704"}, {"criteria": "cpe:2.3:o:canonical:ubuntu_linux:7.04:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6EBDAFF8-DE44-4E80-B6BD-E341F767F501"}], "operator": "OR"}]}], "vendorComments": [{"comment": "This issue is the same as CVE-2007-5365. The affected dhcp versions were fixed via: https://rhn.redhat.com/errata/RHSA-2007-0970.html\n", "lastModified": "2008-06-03T00:00:00", "organization": "Red Hat"}], "sourceIdentifier": "cve@mitre.org"}

10.0 /10