Integer underflow in the DHCP server in EMC VMware Workstation before 5.5.5 Build 56455 and 6.x before 6.0.1 Build 55017, Player before 1.0.5 Build 56455 and Player 2 before 2.0.1 Build 55017, ACE before 1.0.3 Build 54075 and ACE 2 before 2.0.1 Build 55017, and Server before 1.0.4 Build 56528 allows remote attackers to execute arbitrary code via a malformed DHCP packet that triggers a stack-based buffer overflow.
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ace | Vmware | 1.0 (including) | 1.0.3 (excluding) |
| Ace | Vmware | 2.0 (including) | 2.0.1 (excluding) |
| Player | Vmware | 1.0 (including) | 1.0.5 (excluding) |
| Player | Vmware | 2.0 (including) | 2.0.1 (excluding) |
| Server | Vmware | 1.0 (including) | 1.0.4 (excluding) |
| Workstation | Vmware | 5.5 (including) | 5.5.5 (excluding) |
| Workstation | Vmware | 6.0 (including) | 6.0.1 (excluding) |
| Esx | Vmware | 2.0.2 (including) | 2.0.2 (including) |
| Esx | Vmware | 2.1.3 (including) | 2.1.3 (including) |
| Esx | Vmware | 2.5.3 (including) | 2.5.3 (including) |
| Esx | Vmware | 2.5.4 (including) | 2.5.4 (including) |
| Esx | Vmware | 3.0.0 (including) | 3.0.0 (including) |
| Esx | Vmware | 3.0.1 (including) | 3.0.1 (including) |
| Red Hat Enterprise Linux 2.1 | RedHat | dhcp-1:2.0pl5-11 | * |
| Linux-restricted-modules-2.6.17 | Ubuntu | edgy | * |
| Linux-restricted-modules-2.6.17 | Ubuntu | upstream | * |
| Linux-restricted-modules-2.6.20 | Ubuntu | feisty | * |
| Linux-restricted-modules-2.6.20 | Ubuntu | upstream | * |
| Vmware-player | Ubuntu | upstream | * |
| Vmware-player-kernel-2.6.15 | Ubuntu | dapper | * |
| Vmware-player-kernel-2.6.15 | Ubuntu | upstream | * |
| Vmware-server | Ubuntu | feisty | * |
| Vmware-server | Ubuntu | gutsy | * |
| Vmware-server | Ubuntu | upstream | * |