CVE:CVE-2010-4297
CNNVD:CNNVD-201012-067
VMware是一款虚拟PC软件，允许在一台机器上同时运行两个或多个Windows、DOS、LINUX系统。
VMware Server VI Web Access中存在安全漏洞，本地恶意用户可通过此漏洞泄露敏感信息。
此漏洞源于VI Web Access界面中存在输入验证错误，可通过发送到TCP端口8307的目录遍历序列访问任意文件。
solution:Upgrade vmware workstation to a higher version than 6.5.0,6.5.1,6.5.2,6.5.3,6.5.5,7.0,7.0.1,7.1,7.1.1,7.1.2,and avoid the version 6.5.0,6.5.1,6.5.2,6.5.3,6.5.5,7.0,7.0.1,7.1,7.1.1,7.1.2; Upgrade vmware player to a higher version than 2.5,2.5.1,2.5.2,2.5.3,2.5.4,2.5.5,3.1,3.1.1,3.1.2,and avoid the version 2.5,2.5.1,2.5.2,2.5.3,2.5.4,2.5.5,3.1,3.1.1,3.1.2; Upgrade vmware fusion to a higher version than 2.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.0.6,2.0.7,2.0.8,3.1,3.1.1,3.1.2,and avoid the version 2.0,2.0.1,2.0.2,2.0.3,2.0.4,2.0.5,2.0.6,2.0.7,2.0.8,3.1,3.1.1,3.1.2; Upgrade vmware esxi to a higher version than 3.5,4.0,4.1,and avoid the version 3.5,4.0,4.1; Upgrade vmware esx to a higher version than 3.5,4.0,4.1,and avoid the version 3.5,4.0,4.1