Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2008-3691: VMware Workstation, Player, ACE, Server may be remotely attacked

CVE-2008-3691 · published 18 years ago

Summary

Several older versions of VMware Workstation, Player, ACE and Server contain an unknown flaw that could let an attacker connect over the network and potentially take control of the host. The exact damage is not known, but the risk is that the system could be compromised without the user’s knowledge. Upgrade to the latest released builds or apply any patches provided by VMware as soon as possible.

What to do

Update vmware server to version 1.0.7 or later.

Affected software

Vendor	Product	Affected versions
vmware	ace	>= 1.0, < 1.0.7 >= 2.0, < 2.0.5 `cpe:2.3:a:vmware:ace::::::::`
vmware	player	>= 1.0.0, < 1.0.8 >= 2.0, < 2.0.5 `cpe:2.3:a:vmware:player::::::::`
vmware	server	< 1.0.7 `cpe:2.3:a:vmware:server::::::::`
vmware	workstation	>= 5.5, < 5.5.8 >= 6.0, < 6.0.5 `cpe:2.3:a:vmware:workstation::::::::`

Original advisory text

Unspecified vulnerability in a certain ActiveX control in VMware Workstation 5.5.x before 5.5.8 build 108000, VMware Workstation 6.0.x before 6.0.5 build 109488, VMware Player 1.x before 1.0.8 build 108000, VMware Player 2.x before 2.0.5 build 109488, VMware ACE 1.x before 1.0.7 build 108880, VMware ACE 2.x before 2.0.5 build 109488, and VMware Server before 1.0.7 build 108231 has unknown impact and remote attack vectors, a different vulnerability than CVE-2008-3692, CVE-2008-3693, CVE-2008-3694, CVE-2008-3695, and CVE-2008-3696.

References

http://secunia.com/advisories/31707 Patch Third Party Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2008-August/064118.html Third Party Advisory
http://secunia.com/advisories/31708 Patch Third Party Advisory
http://secunia.com/advisories/31709 Patch Third Party Advisory
http://secunia.com/advisories/31710 Patch Third Party Advisory
http://securityreason.com/securityalert/4202 Third Party Advisory
http://www.securityfocus.com/archive/1/495869/100/0/threaded Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/30934 Third Party Advisory VDB Entry
http://www.securitytracker.com/id?1020791 Third Party Advisory VDB Entry
http://www.vmware.com/security/advisories/VMSA-2008-0014.html Vendor Advisory
http://www.vmware.com/support/ace/doc/releasenotes_ace.html Vendor Advisory
http://www.vmware.com/support/ace2/doc/releasenotes_ace2.html Vendor Advisory
http://www.vmware.com/support/player/doc/releasenotes_player.html Vendor Advisory
http://www.vmware.com/support/player2/doc/releasenotes_player2.html Vendor Advisory
http://www.vmware.com/support/server/doc/releasenotes_server.html Vendor Advisory
http://www.vmware.com/support/ws55/doc/releasenotes_ws55.html Vendor Advisory
http://www.vmware.com/support/ws6/doc/releasenotes_ws6.html Vendor Advisory
http://www.vupen.com/english/advisories/2008/2466 Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

4% chance of attack within 30 days

Timeline

Published3 Sep 2008

Updated23 Oct 2026

First seen29 Sep 2026

Sources

CVE-2008-3691 · NVD

Track software like this

Free during beta