VMWare Virtual 8086 Linux Local Ring0 Exploit

############################### # EDB-ID: 10207 # CVE-ID: (CVE-2009-2267) # Title: VMWare Virtual 8086 Linux Local Ring0 Exploit # Author: Tavis Ormandy and Julien Tinnes # Published: 2009-10-27 # Download N/A ############################### Bugtraq ID: 36841 Class: Design Error Published: Oct 27 2009 12:00AM Updated: Oct 27 2009 09:18PM Credit: Tavis Ormandy and Julien Tinnes of the Google Security Team Vulnerable: VMWare Workstation 6.5.3 VMWare Workstation 6.5.2 build 156735 VMWare Workstation 6.5.2 VMWare Workstation 6.5.1 VMWare Workstation 6.5 build 118166 VMWare Server 2.0.1 build 156745 VMWare Server 2.0.1 VMWare Server 1.0.9 build 156507 VMWare Server 1.0.9 VMWare Server 1.0.8 build 126538 VMWare Server 1.0.8 VMWare Server 1.0.7 build 108231 VMWare Server 1.0.7 VMWare Server 1.0.6 build 91891 VMWare Server 1.0.6 VMWare Server 1.0.5 Build 80187 VMWare Server 1.0.5 VMWare Server 1.0.4 VMWare Server 1.0.3 VMWare Server 1.0.2 VMWare Server 2.0 VMWare Player 2.5.3 VMWare Player 2.5.2 build 156735 VMWare Player 2.5.2 VMWare Player 2.5.1 VMWare Player 2.5 build 118166 VMWare Fusion 2.0.6 VMWare Fusion 2.0.5 VMWare Fusion 2.0.4 VMWare Fusion 2.0.3 VMWare Fusion 2.0.2 build 147997 VMWare Fusion 2 VMWare ESXi Server 4.0 VMWare ESXi Server 3.5 ESXe350-20090440 VMWare ESXi Server 3.5 VMWare ESX Server 3.0.3 ESX303-200905401-SG VMWare ESX Server 3.0.3 ESX303-200812406-BG VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.3 VMWare ESX Server 3.0.2 ESX-1008420 VMWare ESX Server 3.0.2 VMWare ESX Server 3.0.1 VMWare ESX Server 3.0 VMWare ESX Server 2.5.5 patch 9 VMWare ESX Server 2.5.5 patch 8 VMWare ESX Server 2.5.5 patch 6 VMWare ESX Server 2.5.5 patch 4 VMWare ESX Server 2.5.5 patch 2 VMWare ESX Server 2.5.5 patch 13 VMWare ESX Server 2.5.5 patch 12 VMWare ESX Server 2.5.5 patch 11 VMWare ESX Server 2.5.5 patch 10 VMWare ESX Server 2.5.5 VMWare ESX Server 2.5.4 patch 21 VMWare ESX Server 2.5.4 patch 19 VMWare ESX Server 2.5.4 Patch 17 VMWare ESX Server 2.5.4 Patch 16 VMWare ESX Server 2.5.4 patch 15 VMWare ESX Server 2.5.4 patch 13 VMWare ESX Server 2.5.4 Patch 1 VMWare ESX Server 2.5.4 VMWare ESX Server 2.5.4 VMWare ESX Server 2.5.4 VMWare ESX Server 2.5.4 VMWare ESX Server 2.5.3 Patch 4 VMWare ESX Server 2.5.3 VMWare ESX Server 2.5.3 VMWare ESX Server 2.5.3 VMWare ESX Server 2.5.3 VMWare ESX Server 2.5.3 VMWare ESX Server 2.5.3 VMWare ESX Server 2.5.2 VMWare ESX Server 2.5 VMWare ESX Server 2.1.3 Patch 2 VMWare ESX Server 2.1.3 VMWare ESX Server 2.1.3 VMWare ESX Server 2.1.3 VMWare ESX Server 2.1.3 VMWare ESX Server 2.1.2 VMWare ESX Server 2.1.1 VMWare ESX Server 2.1 VMWare ESX Server 2.0.2 Patch 2 VMWare ESX Server 2.0.2 VMWare ESX Server 2.0.2 VMWare ESX Server 2.0.2 VMWare ESX Server 2.0.2 VMWare ESX Server 2.0.1 build 6403 VMWare ESX Server 2.0.1 VMWare ESX Server 2.0 build 5257 VMWare ESX Server 2.0 VMWare ESX Server 4.0 VMWare ESX Server 4.0 VMWare ESX Server 3.5 ESX350-200906407 VMWare ESX Server 3.5 ESX350-200904401 VMWare ESX Server 3.5 VMWare ESX Server 2.5.5 patch 5 VMWare ESX Server 2.5.3 Patch 2 VMWare ESX Server 2.5.2 Patch 4 VMWare ESX Server 2.1.3 Patch 1 VMWare ESX Server 2.0.2 Patch 1 VMWare ACE 2.5.2 build 156735 VMWare ACE 2.5.2 VMWare ACE 2.5.1 VMWare ACE 2.5 build 118166 Not Vulnerable: VMWare Workstation 6.5.3 build 185404 VMWare Server 2.0.2 Build 203138 VMWare Server 1.0.10 Build 203137 VMWare Player 2.5.3 build 185404 VMWare Fusion 2.0.6 Build 196839 VMWare ESXi Server 4.0 ESXi400-20090940 VMWare ESXi Server 3.5 ESXe350-20091040 VMWare ESX Server 3.0.3 ESX303-200910401-BG VMWare ESX Server 2.5.5 patch 15 VMWare ESX Server 4.0 ESX400-200909401 VMWare ESX Server 3.5 ESX350-200910401 VMWare ACE 2.5.3 Build 185404 Exploit: http://www.exploit-db.com/sploits/2009-11-22-vmware86.tar.gz