$ cve CVE-2009-3707 JSON

CVE-2009-3707 EXPLOIT

5.0

MEDIUM · CVSS 2.0 · EPSS 11.1% (pctl 96)

Patch early

A public exploit exists.

Description

VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \x25\xFF sequence in the USER and PASS commands, related to a "format string DoS" issue. NOTE: some of these details are obtained from third party information.

Scoring

CVSS	5.0 (MEDIUM, v2.0)
Vector	AV:N/AC:L/Au:N/C:N/I:N/A:P
EPSS	11.11% — more likely to be exploited than 96% of all CVEs
Weakness	CWE-134
On CISA KEV	no
Public exploit	yes
Published	2009-10-16
Last modified	2026-06-16

Affected (4)

Vendor	Product
vmware	ace
vmware	player
vmware	server
vmware	workstation

Public exploits

Source	Title	Date
exploit-db	VMware Player / VMware Workstation 6.5.3 - 'VMware-authd' Remote Denial of Service	2009-10-07

References

→ the Explorer · watch your stack · NVD