CVE:CVE-2009-3731
CNNVD:CNNVD-200912-203
VMWare是一个"虚拟PC"软件.它使你可以在一台机器上同时运行二个或更多Windows、DOS、LINUX系统。VMware vCenter Update 1中的WebWorks Help; VMware Server; VMware ESX; VMware Lab Manager; VMware vCenter Lab Manager; VMware Stage Manager; WebWorks Publisher; WebWorks Publisher 2003;和WebWorks ePublisher中存在多个跨站脚本漏洞，远程攻击者可以通过以下文件注入任意web脚本或HTML：(1)index.html和wwhsec.htm中的wwhelp_entry.html, (2) wwhelp/wwhimpl/api.htm, (3) wwhelp/wwhimpl/common/html/frameset.htm, (4) wwhelp/wwhimpl/common/scripts/switch.js,或(5)wwhelp/wwhimpl/common/html/bookmark.htm中的window.opener构成,与(a)未明参数和(b)书签功能的主题链接使用的信息有关。
solution:Upgrade webworks epublisher to a higher version than 9.0,9.1,9.2,9.3,2008.1,2008.2,2008.3,2008.4,2009.1,2009.2,and avoid the version 9.0,9.1,9.2,9.3,2008.1,2008.2,2008.3,2008.4,2009.1,2009.2; Upgrade webworks help to a higher version than 2.0,3.0,4.0,5.0,and avoid the version 2.0,3.0,4.0,5.0; Upgrade webworks publisher to a higher version than 6.0,7.0,8.0,2003,and avoid the version 6.0,7.0,8.0,2003; Upgrade vmware vcenter to a higher version than 4.0,and avoid the version 4.0; Upgrade vmware esx_server to a higher version than 4.0,and avoid the version 4.0; Upgrade vmware lab_manager to a higher version than 2.0,and avoid the version 2.0; Upgrade vmware server to a higher version than 2.0.2,and avoid the version 2.0.2; Upgrade vmware stage_manager to a higher version than 4.0,1.0,and avoid the version (,4.0],1.0; Upgrade vmware vcenter_lab_manager to a higher version than 3.0,3.0.1,3.0.2,4.0,and avoid the version 3.0,3.0.1,3.0.2,4.0; Upgrade vmware vcenter_stage_manager to a higher version than 1.0.1,and avoid the version 1.0.1