:. GOODFELLAS Security Research TEAM .: :. http://goodfellas.shellcode.com.ar .: VmWare Inc version 6.0.0 CreateProcess & CreateProcessEx Remode Code Execution Exploit ====================================================================================== Internal ID: VULWAR200707300. ----------- Introduction ------------ vielib.dll is a library included in the Program Vmware Version 6.0.0 from Vmware Inc. Company. Tested In --------- - Windows XP SP1/SP2 french/english with IE 6.0 / 7.0. Summary ------- The CreateProcess & CreateProcessEx method doesn't check if they're being called from the application, or malicious users. Remote Attacker could craft a html page and execute code in a remote system with the actual user privileges. Impact ------ Any computer that uses this Sofware will be exposed to Remote Execution Code. Workaround ---------- - Activate the Kill bit zero in clsid:0F748FDE-0597-443C-8596-71854C5EA20A - Unregister vielib.dll using regsvr32. Timeline -------- July 30 2007 -- Bug Discovery. July 30 2007 -- Exploit published. Credits ------- * callAX * GoodFellas Security Research Team Technical Details -----------------