« Volver al listado

CVE-2009-1542

Estado: ModificadaAlta (9)—

The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, does not enforce CPU privilege-level requirements for all machine instructions, which allows guest OS users to execute arbitrary kernel-mode code and gain privileges within the guest OS via a crafted application, aka "Virtual PC and Virtual Server Privileged Instruction Decoding Vulnerability."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Virtual PCMicrosoft — Virtual Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-1542",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "authentication": "SINGLE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-07-15T15:30:01.420",
  "references": [
    {
      "url": "http://secunia.com/advisories/35808",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id?1022544",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-195A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/1890",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-033",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6166",
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://secunia.com/advisories/35808",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id?1022544",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.us-cert.gov/cas/techalerts/TA09-195A.html",
      "tags": [
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/1890",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-033",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6166",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The Virtual Machine Monitor (VMM) in Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, does not enforce CPU privilege-level requirements for all machine instructions, which allows guest OS users to execute arbitrary kernel-mode code and gain privileges within the guest OS via a crafted application, aka \"Virtual PC and Virtual Server Privileged Instruction Decoding Vulnerability.\""
    },
    {
      "lang": "es",
      "value": "El Virtual Machine Monitor (VMM)  en Microsoft Virtual PC 2004 SP1, 2007, and 2007 SP1, and Microsoft Virtual Server 2005 R2 SP1, no impone los requisitos de la CPU (privilege-level) para todas las instrucciones de la maquina, lo que permite a usuarios del sistema invitado (guest) ejecutar código de su elección en modo kernel (kernel -mode) y obtener privilegios dentro del sistema invitado a través de aplicaciones manipuladas. También conocido como \"Vulnerabilidad de decodificación de instrucciones privilegiadas en Virtual PC y Virtual Server\"."
    }
  ],
  "lastModified": "2026-06-16T23:07:29.310",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:virtual_pc:2004:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4B85AEB7-0AB3-4AFA-B589-74DF583225C4"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:virtual_pc:2007:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E550D9F-C197-4EA1-A018-73C0E8B03E6C"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:virtual_pc:2007:*:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F61DD9A1-A925-4FA3-BD6A-708F039F7F9B"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:virtual_pc:2007:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "98616FA1-76B2-40C1-806E-71A4D76CB5D1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:virtual_server:2005:r2_sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5705C94-8B44-48D7-873B-1909FE2D020E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:virtual_server:2005:r2_sp1:x64:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "35C436EF-6A98-47F7-BA5E-2E4B8497045F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}