CVE-2011-2217 Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Client (aka VMware Infrastructure Client) 2.0.2 before Build 2...
HighCVSS 9.3
EPSS 42.0%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Certain ActiveX controls in (1) tsgetxu71ex552.dll and (2) tsgetx71ex552.dll in Tom Sawyer GET Extension Factory 5.5.2.237, as used in VI Client (aka VMware Infrastructure Client) 2.0.2 before Build 230598 and 2.5 before Build 204931 in VMware Infrastructure 3, do not properly handle attempted initialization within Internet Explorer, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted HTML document.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| tomsawyer get extension factory | = 5.5.2.237 | No fix listed |
| VMware virtual infrastructure client | = 2.0.2 | No fix listed |
| VMware virtual infrastructure client | = 2.5 | No fix listed |
| VMware infrastructure | = 3 | No fix listed |
References
- 20110603 Tom Sawyer GET Extension Factory COM Object Instantiation Memory Corruption Vulnerability third-party-advisory
- 44826 third-party-advisory vendor-advisory
- 44844 third-party-advisory
- 1025602 vdb-entry
- 48099 vdb-entry
- www.vmware.com vendor-advisory
- vmware-viclient-code-exec(67816) vdb-entry