製品・ソフトウェアに関する情報

JVN脆弱性詳細

VMware Authorization Service の VMware Authentication Daemon におけるサービス運用妨害 (DoS) の脆弱性

Title	VMware Authorization Service の VMware Authentication Daemon におけるサービス運用妨害 (DoS) の脆弱性
Summary	複数の VMware 製品の VMware Authorization Service の VMware Authentication Daemon には、サービス運用妨害 (DoS) 状態となる脆弱性が存在します。
Possible impacts	第三者により、USER および PASS コマンドの \x25\xFF シーケンスを介して、サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Oct. 16, 2009, midnight
Registration Date	May 7, 2010, 5:26 p.m.
Last Update	May 7, 2010, 5:26 p.m.

Affected System

VMware

VMware ACE 2.5.x

VMware ACE 2.6

VMware Player 2.5.x

VMware Player 3.0

VMware Server 2.x

VMware Workstation 6.5.x

VMware Workstation 7.0

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-3707	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3707
National Vulnerability Database (NVD)
2	CVE-2009-3707	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-3707

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-134	https://jvndb.jvn.jp/ja/cwe/CWE-134.html

ベンダー情報

No	Name	URL
VMware Security Advisories
1	VMSA-2010-0007	http://www.vmware.com/security/advisories/VMSA-2010-0007.html

その他

No	Name	URL
Secunia Advisory
1	SA36988	http://secunia.com/advisories/36988
2	SA39206	http://secunia.com/advisories/39206
3	SA39215	http://secunia.com/advisories/39215
SecurityFocus
4	36630	http://www.securityfocus.com/bid/36630
SecurityTracker
5	1022997	http://www.securitytracker.com/id?1022997
VUPEN Security
6	VUPEN/ADV-2010-0852	http://www.vupen.com/english/advisories/2010/0852

Change Log

No	Changed Details	Date of change
0	[2010年05月07日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2009-3707

Summary	VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \x25\xFF sequence in the USER and PASS commands, related to a "format string DoS" issue. NOTE: some of these details are obtained from third party information.
Publication Date	Oct. 17, 2009, 1:30 a.m.
Registration Date	Jan. 29, 2021, 1:24 p.m.
Last Update	Feb. 14, 2024, 10:17 a.m.

Affected software configurations

Related information, measures and tools

No	URL	refsource	タグ
1	http://www.shinnai.net/index.php?mod=02_Forum&group=02_Bugs_and_Exploits&argument=01_Remote&topic=1254924405.ff.php	MISC	URL Repurposed
2	http://securitytracker.com/id?1022997	SECTRACK
3	http://www.shinnai.net/xplits/TXT_JtYUv6C6j5b6Bw6iIkF4.html	MISC	Exploit URL Repurposed
4	http://secunia.com/advisories/36988	SECUNIA	Vendor Advisory
5	http://www.vmware.com/security/advisories/VMSA-2010-0007.html	CONFIRM
6	http://secunia.com/advisories/39206	SECUNIA
7	http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html	BUGTRAQ
8	http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html	FULLDISC
9	http://lists.vmware.com/pipermail/security-announce/2010/000090.html	MLIST
10	http://secunia.com/advisories/39215	SECUNIA
11	http://www.securityfocus.com/bid/36630	BID
12	http://www.shinnai.net/exploits/abFwcLOuFqmD20yqhYpQ.txt	MISC	URL Repurposed
13	http://security.gentoo.org/glsa/glsa-201209-25.xml	GENTOO

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-134	書式文字列の問題	https://cwe.mitre.org/data/definitions/134.html