CVE-2013-3657 : Buffer overflow in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to execute arbitrary code o

Buffer overflow in VMware ESXi 4.0 through 5.0, and ESX 4.0 and 4.1, allows remote attackers to execute arbitrary code or cause a denial of service via unspecified vectors.

Published 2013-09-10 11:28:41

Updated 2013-09-13 18:01:13

Source JPCERT/CC

View at NVD, CVE.org

Vulnerability category: OverflowExecute codeDenial of service

Threat overview for CVE-2013-3657

Top countries where our scanners detected CVE-2013-3657

Top open port discovered on systems with this issue 443

IPs affected by CVE-2013-3657 33

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2013-3657!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2013-3657

Probability of exploitation activity in the next 30 days: 1.76%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 88 % EPSS Score History EPSS FAQ

CVSS scores for CVE-2013-3657

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2013-3657

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2013-3657

http://jvn.jp/en/jp/JVN19847770/index.html

JVN#19847770: VMware ESX and ESXi vulnerable to buffer overflow
http://jvn.jp/en/jp/JVN19847770/995428/index.html

Japan Vulnerability Notes/Information from VMware, Inc.
http://jvndb.jvn.jp/jvndb/JVNDB-2013-000085

JVNDB-2013-000085 - JVN iPedia - 脆弱性対策情報データベース

Products affected by CVE-2013-3657