CVE-2009-4811

VMware Authentication Daemon 1.0 in vmware-authd.exe in the VMware Authorization Service in VMware Workstation 7.0 before 7.0.1 build 227600 and 6.5.x before 6.5.4 build 246459, VMware Player 3.0 before 3.0.1 build 227600 and 2.5.x before 2.5.4 build 246459, VMware ACE 2.6 before 2.6.1 build 227600 and 2.5.x before 2.5.4 build 246459, and VMware Server 2.x allows remote attackers to cause a denial of service (process crash) via a \x25\x90 sequence in the USER and PASS commands, a related issue to CVE-2009-3707. NOTE: some of these details are obtained from third party information.

• CWE-134

• http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html
• http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html
• http://freetexthost.com/qr1tffkzpuExploit, URL Repurposed
• http://lists.vmware.com/pipermail/security-announce/2010/000090.htmlPatch, Vendor Advisory
• http://pocoftheday.blogspot.com/2009/10/vmware-server-20x-remote-dos-exploit.htmlExploit
• http://security.gentoo.org/glsa/glsa-201209-25.xml
• http://www.securityfocus.com/bid/36630Exploit
• http://www.vmware.com/security/advisories/VMSA-2010-0007.htmlPatch, Vendor Advisory
• http://archives.neohapsis.com/archives/bugtraq/2010-04/0077.html
• http://archives.neohapsis.com/archives/fulldisclosure/2010-04/0121.html
• http://freetexthost.com/qr1tffkzpuExploit, URL Repurposed
• http://lists.vmware.com/pipermail/security-announce/2010/000090.htmlPatch, Vendor Advisory
• http://pocoftheday.blogspot.com/2009/10/vmware-server-20x-remote-dos-exploit.htmlExploit
• http://security.gentoo.org/glsa/glsa-201209-25.xml
• http://www.securityfocus.com/bid/36630Exploit
• http://www.vmware.com/security/advisories/VMSA-2010-0007.htmlPatch, Vendor Advisory

Published

Apr 27, 2010

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-4805Multiple SQL injection vulnerabilities in EZ-Blog Beta 1, wh…
• CVE-2009-4806admin/save_user.asp in Digital Interchange Document Library …
• CVE-2009-4807Multiple SQL injection vulnerabilities in Graugon PHP Articl…
• CVE-2009-4808admin.php in Graugon PHP Article Publisher 1.0 allows remote…
• CVE-2009-4809Directory traversal vulnerability in thumbnail.ghp in Easy F…
• CVE-2009-4810The Secure Remote Password (SRP) implementation in Samhain b…
• CVE-2009-4812Wolfram Research webMathematica allows remote attackers to o…
• CVE-2009-4813Cross-site scripting (XSS) vulnerability in myps.php in MyBB…
• CVE-2009-4814Cross-site scripting (XSS) vulnerability in Wolfram Research…
• CVE-2009-4815Directory traversal vulnerability in Serv-U before 9.2.0.1 a…
• CVE-2009-4816Directory traversal vulnerability in api/download_checker.ph…
• CVE-2009-4817Unrestricted file upload vulnerability in Element-IT Ultimat…