CVE-2011-2217

2011-06-0619:55:03

CWE-119

mitre

web.nvd.nist.gov

cve-2011-2217

activex controls

tom sawyer get

vmware infrastructure client

code execution

denial of service

memory corruption

remote attackers

CVSS2

9.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

AI Score

7.5

Confidence

Low

EPSS

0.949

Percentile

99.3%

JSON

Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Client (aka VMware Infrastructure Client) 2.0.2 before Build 230598 and 2.5 before Build 204931 in VMware Infrastructure 3, do not properly handle attempted initialization within Internet Explorer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HTML document.

Affected configurations

Nvd

Node

tomsawyerget_extension_factoryMatch5.5.2.237

vmwarevirtual_infrastructure_clientMatch2.0.2

vmwarevirtual_infrastructure_clientMatch2.5

AND

vmwareinfrastructureMatch3

VendorProductVersionCPE
vmwareinfrastructure3cpe:/a:vmware:infrastructure:3:::
vmwarevirtual_infrastructure_client2.5cpe:/a:vmware:virtual_infrastructure_client:2.5:::
vmwarevirtual_infrastructure_client2.0.2cpe:/a:vmware:virtual_infrastructure_client:2.0.2:::
tomsawyerget_extension_factory5.5.2.237cpe:/a:tomsawyer:get_extension_factory:5.5.2.237:::

Vendor	Product	Version	CPE
vmware	infrastructure	3	cpe:/a:vmware:infrastructure:3:::
vmware	virtual_infrastructure_client	2.5	cpe:/a:vmware:virtual_infrastructure_client:2.5:::
vmware	virtual_infrastructure_client	2.0.2	cpe:/a:vmware:virtual_infrastructure_client:2.0.2:::
tomsawyer	get_extension_factory	5.5.2.237	cpe:/a:tomsawyer:get_extension_factory:5.5.2.237:::