CVE-2008-0923: VMware Ace

Medium severity, CVSS 6.9. EPSS: 0.5% chance of exploitation in the next 30 days.

Directory traversal vulnerability in the Shared Folders feature for VMWare ACE 1.0.2 and 2.0.2, Player 1.0.4 and 2.0.2, and Workstation 5.5.4 and 6.0.2 allows guest OS users to read and write arbitrary files on the host OS via a multibyte string that produces a wide character string containing .. (dot dot) sequences, which bypasses the protection mechanism, as demonstrated using a "%c0%2e%c0%2e" string.

Affected products

• VMware Ace: version 1.0 only; version 1.0.2 only; version 2.0 only; version 2.0.1 only; version 2.0.2 only
• VMware Player: version 1.0.4 only
• VMware VMware Player: version 1.0.1_build_19317 only; version 1.0.2 only; version 1.0.3 only
• VMware VMware Workstation: version 6.0.1 only; version 6.0.2 only
• VMware Workstation: version 4.5.2 only; version 5.5.3_build_34685 only; version 5.5.4 only; version 6.0 only

Published 2008-02-26. Last modified 2026-06-16.