VMware COM API ActiveX Exploit

[tjs]

A vulnerability in VMware's COM API ActiveX allows remote attackers to cause it to overflow an internal buffer which in turn can be used to execute abitrary code. Exploit/vuln testing code available here:
http://www.securiteam.com/exploits/5WP040UPFQ.html

From the perspective of MDL and malware analysis-- this vuln can be embedded on malware distribution sites in order to specifically attack machines running in a vmware emulated environment... The class ID to watch out for is:
38DB77F9-058D-4955-98AA-4A9F3B6A5B06. My usual request applies-- please let me know if you find this in the wild, even though I know nobody will.

TJS

[sowhat-x]

...this is certainly gonna be re-used in newer web-based exploit packs... 

[CM_MWR]

Patch was released some days ago in a update i got,it had 2 others with it as well,both with the same capabilities affecting workstations 5 through 6 but I dont know about player or any other products.