CVE-2008-3761 (GCVE-0-2008-3761)
Vulnerability from cvelistv5
Published
2008-08-21 17:00
Modified
2024-08-07 09:53
Severity ?
CWE
  • n/a
Summary
hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request.
References
cve@mitre.org http://lists.vmware.com/pipermail/security-announce/2009/000054.html
cve@mitre.org http://seclists.org/fulldisclosure/2009/Apr/0036.html
cve@mitre.org http://securityreason.com/securityalert/4177
cve@mitre.org http://www.orange-bat.com/adv/2008/adv.08.17.txt
cve@mitre.org http://www.securityfocus.com/bid/30737
cve@mitre.org http://www.securityfocus.com/bid/34373
cve@mitre.org http://www.securitytracker.com/id?1020715
cve@mitre.org http://www.vmware.com/security/advisories/VMSA-2009-0005.html
cve@mitre.org http://www.vupen.com/english/advisories/2009/0944
cve@mitre.org https://exchange.xforce.ibmcloud.com/vulnerabilities/44539
cve@mitre.org https://www.exploit-db.com/exploits/6262
af854a3a-2127-422b-91ae-364da2661108 http://lists.vmware.com/pipermail/security-announce/2009/000054.html
af854a3a-2127-422b-91ae-364da2661108 http://seclists.org/fulldisclosure/2009/Apr/0036.html
af854a3a-2127-422b-91ae-364da2661108 http://securityreason.com/securityalert/4177
af854a3a-2127-422b-91ae-364da2661108 http://www.orange-bat.com/adv/2008/adv.08.17.txt
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/bid/30737
af854a3a-2127-422b-91ae-364da2661108 http://www.securityfocus.com/bid/34373
af854a3a-2127-422b-91ae-364da2661108 http://www.securitytracker.com/id?1020715
af854a3a-2127-422b-91ae-364da2661108 http://www.vmware.com/security/advisories/VMSA-2009-0005.html
af854a3a-2127-422b-91ae-364da2661108 http://www.vupen.com/english/advisories/2009/0944
af854a3a-2127-422b-91ae-364da2661108 https://exchange.xforce.ibmcloud.com/vulnerabilities/44539
af854a3a-2127-422b-91ae-364da2661108 https://www.exploit-db.com/exploits/6262
Impacted products
Vendor Product Version
n/a n/a Version: n/a
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:53:00.346Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "vmware-workstation-hcmon-dos(44539)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44539"
          },
          {
            "name": "4177",
            "tags": [
              "third-party-advisory",
              "x_refsource_SREASON",
              "x_transferred"
            ],
            "url": "http://securityreason.com/securityalert/4177"
          },
          {
            "name": "20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2009/Apr/0036.html"
          },
          {
            "name": "30737",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30737"
          },
          {
            "name": "34373",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/34373"
          },
          {
            "name": "1020715",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1020715"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.orange-bat.com/adv/2008/adv.08.17.txt"
          },
          {
            "name": "ADV-2009-0944",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2009/0944"
          },
          {
            "name": "[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://lists.vmware.com/pipermail/security-announce/2009/000054.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html"
          },
          {
            "name": "6262",
            "tags": [
              "exploit",
              "x_refsource_EXPLOIT-DB",
              "x_transferred"
            ],
            "url": "https://www.exploit-db.com/exploits/6262"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-08-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-09-28T12:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "vmware-workstation-hcmon-dos(44539)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44539"
        },
        {
          "name": "4177",
          "tags": [
            "third-party-advisory",
            "x_refsource_SREASON"
          ],
          "url": "http://securityreason.com/securityalert/4177"
        },
        {
          "name": "20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://seclists.org/fulldisclosure/2009/Apr/0036.html"
        },
        {
          "name": "30737",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30737"
        },
        {
          "name": "34373",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/34373"
        },
        {
          "name": "1020715",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1020715"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.orange-bat.com/adv/2008/adv.08.17.txt"
        },
        {
          "name": "ADV-2009-0944",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2009/0944"
        },
        {
          "name": "[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://lists.vmware.com/pipermail/security-announce/2009/000054.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html"
        },
        {
          "name": "6262",
          "tags": [
            "exploit",
            "x_refsource_EXPLOIT-DB"
          ],
          "url": "https://www.exploit-db.com/exploits/6262"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3761",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "vmware-workstation-hcmon-dos(44539)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44539"
            },
            {
              "name": "4177",
              "refsource": "SREASON",
              "url": "http://securityreason.com/securityalert/4177"
            },
            {
              "name": "20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues",
              "refsource": "FULLDISC",
              "url": "http://seclists.org/fulldisclosure/2009/Apr/0036.html"
            },
            {
              "name": "30737",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30737"
            },
            {
              "name": "34373",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/34373"
            },
            {
              "name": "1020715",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1020715"
            },
            {
              "name": "http://www.orange-bat.com/adv/2008/adv.08.17.txt",
              "refsource": "MISC",
              "url": "http://www.orange-bat.com/adv/2008/adv.08.17.txt"
            },
            {
              "name": "ADV-2009-0944",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2009/0944"
            },
            {
              "name": "[security-announce] 20090403 VMSA-2009-0005 VMware Hosted products, VI Client and patches for ESX and ESXi resolve multiple security issues",
              "refsource": "MLIST",
              "url": "http://lists.vmware.com/pipermail/security-announce/2009/000054.html"
            },
            {
              "name": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html",
              "refsource": "CONFIRM",
              "url": "http://www.vmware.com/security/advisories/VMSA-2009-0005.html"
            },
            {
              "name": "6262",
              "refsource": "EXPLOIT-DB",
              "url": "https://www.exploit-db.com/exploits/6262"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3761",
    "datePublished": "2008-08-21T17:00:00",
    "dateReserved": "2008-08-21T00:00:00",
    "dateUpdated": "2024-08-07T09:53:00.346Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2008-3761\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2008-08-21T17:41:00.000\",\"lastModified\":\"2025-04-09T00:30:58.490\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"hcmon.sys in VMware Workstation 6.5.1 and earlier, VMware Player 2.5.1 and earlier, VMware ACE 2.5.1 and earlier, and VMware Server 1.0.x before 1.0.9 build 156507 and 2.0.x before 2.0.1 build 156745 uses the METHOD_NEITHER communication method for IOCTLs, which allows local users to cause a denial of service via a crafted IOCTL request.\"},{\"lang\":\"es\",\"value\":\"hcmon.sys en VMware Workstation 6.0.0.45731 utiliza el m\u00e9todo de comunicaci\u00f3n METHOD_NEITHER para IOCTLs, lo cual tiene un impacto desconocido (posiblemente ca\u00edda) y vectores de ataque locales a trav\u00e9s de una petici\u00f3n IOCTL manipulada.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:N/I:N/A:C\",\"baseScore\":4.9,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:vmware:vmware_workstation:6.0.0.45731:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F01ABD8-5C77-422E-849C-E7460072DB0B\"}]}]}],\"references\":[{\"url\":\"http://lists.vmware.com/pipermail/security-announce/2009/000054.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://seclists.org/fulldisclosure/2009/Apr/0036.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securityreason.com/securityalert/4177\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.orange-bat.com/adv/2008/adv.08.17.txt\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/30737\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/34373\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securitytracker.com/id?1020715\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vmware.com/security/advisories/VMSA-2009-0005.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0944\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/44539\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.exploit-db.com/exploits/6262\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://lists.vmware.com/pipermail/security-announce/2009/000054.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://seclists.org/fulldisclosure/2009/Apr/0036.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securityreason.com/securityalert/4177\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.orange-bat.com/adv/2008/adv.08.17.txt\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/30737\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/34373\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securitytracker.com/id?1020715\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vmware.com/security/advisories/VMSA-2009-0005.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2009/0944\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/44539\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.exploit-db.com/exploits/6262\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.