VYPR
← All advisories
Unrated severityNVD Advisory· Published Feb 26, 2008· Updated Apr 23, 2026

CVE-2008-0923

CVE-2008-0923

Description

Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character string containing .. (dot dot) sequences, which bypasses the protection mechanism, as demonstrated using a "%c0%2e%c0%2e" string.

Affected products

15
  • VMware/Ace5 versions
    cpe:2.3:a:vmware:ace:1.0:*:*:*:*:*:*:*+ 4 more
    • cpe:2.3:a:vmware:ace:1.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:ace:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:ace:2.0:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:ace:2.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:ace:2.0.2:*:*:*:*:*:*:*
  • VMware/Player4 versions
    cpe:2.3:a:vmware:player:1.0.4:*:*:*:*:*:*:*+ 3 more
    • cpe:2.3:a:vmware:player:1.0.4:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:vmware_player:1.0.1_build_19317:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:vmware_player:1.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:vmware_player:1.0.3:*:*:*:*:*:*:*
  • VMware/Workstation6 versions
    cpe:2.3:a:vmware:vmware_workstation:6.0.1:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:vmware:vmware_workstation:6.0.1:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:vmware_workstation:6.0.2:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:workstation:4.5.2:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:workstation:5.5.3_build_34685:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:workstation:5.5.4:*:*:*:*:*:*:*
    • cpe:2.3:a:vmware:workstation:6.0:*:*:*:*:*:*:*

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

20

News mentions

0

No linked articles in our index yet.