CVE-2010-1138 Information disclosure in n/a
Remote attackers can read sensitive host memory by sending crafted network packets to VMware virtual machines, exposing host data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2010-1138?
CVE-2010-1138 is a medium-severity vulnerability in Vmware Fusion, published on 12 Apr 2010. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The virtual networking stack in VMware Workstation 7.0 before 7.0.1 build 227600, VMware Workstation 6.5.x before 6.5.4 build 246459 on Windows, VMware Player 3.0 before 3.0.1 build 227600, VMware Player 2.5.x before 2.5.4 build 246459 on Windows, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware Server 2.x, and VMware Fusion 3.0 before 3.0.1 build 232708 and 2.x before 2.0.7 build 246742 allows remote attackers to obtain sensitive information from memory on the host OS by examining received network packets, related to interaction between the guest OS and the host vmware-vmx process.
Weakness: CWE-200
Which versions are affected by CVE-2010-1138?
It affects 5 products.
Products include Vmware Ace, Vmware Fusion, Vmware Player, Vmware Server, Vmware Workstation.
How do I fix CVE-2010-1138?
No fix has been published for CVE-2010-1138 yet. Limit exposure of the affected software until one is available.
Is CVE-2010-1138 being exploited?
There is no known exploitation of CVE-2010-1138 in the wild and no public exploit code.
Other vulnerabilities in Vmware Fusion
Sources
Also known as GHSA-vg5m-v3m5-vjcf.