:. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: IntraProcessLogging.dll 5.5.3.42958 VmWare Inc Arbitrary Data Write =================================================================== Internal ID: VULWAR200707284. ----------- Introduction ------------ IntraProcessLogging.dll is a library included in the Program Vmware Workstation from Vmware Inc. Company. Tested In --------- - Windows XP SP1/SP2 french/english with IE 6.0 / 7.0. Summary ------- The SetLogFileName method doesn't check if it's being called from the application or from a malicious user. A Remote Attacker could craft a html page and overwrite arbitrary files in a system. Impact ------ The vulnerability could allow malicious users to write arbitrary data on a vulnerable system that uses this software. Workaround ---------- - Activate the Kill bit zero in the clsid corresponding to the software. - Unregister IntraProcessLogging.dll using regsvr32. Timeline -------- July 28 2007 -- Bug Discovery. July 30 2007 -- POC published. Credits ------- * callAX * GoodFellas Security Research Team Technical Details ----------------- SetLogFileName method receives one argument filename in this format "c:\path\file". Proof of Concept ----------------