{"schemaVersion":3,"id":"CVE-2005-4459","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Heap-based buffer overflow in the NAT networking components vmnat.exe and vmnet-natd in VMWare Workstation 5.5, GSX Server 3.2, ACE 1.0.1, and Player 1.0 allows remote authenticated attackers, including guests, to execute arbitrary code via crafted (1) EPRT and (2) PORT FTP commands.","dates":{"published":"2005-12-21T20:00:00.000Z","modified":"2024-08-07T23:46:05.391Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":10,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":10,"severity":"high","vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.14235,"percentile":0.9656,"severity":"medium","asOf":"2026-10-18T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-18T00:00:00.000Z","baselineScore":0.14235},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.14235,"percentile":0.9656}],"last30":[{"date":"2026-09-18T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.14235,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.14235,"percentile":0.9656}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_B773403F52F2213B","name":"Exploit Reference (lists.grok.org.uk)","source":"reference","url":"http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040442.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"vmware","product":"ace","name":"ace","label":"ace","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.0.1","eol":null,"hubHref":"/vendor/vmware/ace"},{"vendor":"vmware","product":"gsx_server","name":"gsx server","label":"gsx_server","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.0","noFixRecorded":false,"fixedIn":null},{"text":"2.0.1_build_2129","noFixRecorded":false,"fixedIn":null},{"text":"2.5.1","noFixRecorded":false,"fixedIn":null},{"text":"2.5.1_build_5336","noFixRecorded":false,"fixedIn":null},{"text":"2.5.2","noFixRecorded":false,"fixedIn":null},{"text":"3.0","noFixRecorded":false,"fixedIn":null},{"text":"3.0_build_7592","noFixRecorded":false,"fixedIn":null},{"text":"3.1","noFixRecorded":false,"fixedIn":null},{"text":"3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.0 | 2.0.1_build_2129 | 2.5.1 | 2.5.1_build_5336 | 2.5.2 | 3.0 | 3.0_build_7592 | 3.1 | 3.2","eol":null,"hubHref":"/vendor/vmware/gsx_server"},{"vendor":"vmware","product":"player","name":"player","label":"player","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.0.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.0.0","eol":null,"hubHref":"/vendor/vmware/player"},{"vendor":"vmware","product":"workstation","name":"workstation","label":"workstation","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"3.2.1:patch1","noFixRecorded":false,"fixedIn":null},{"text":"3.4","noFixRecorded":false,"fixedIn":null},{"text":"4.0","noFixRecorded":false,"fixedIn":null},{"text":"4.0.1","noFixRecorded":false,"fixedIn":null},{"text":"4.0.2","noFixRecorded":false,"fixedIn":null},{"text":"4.5.2","noFixRecorded":false,"fixedIn":null},{"text":"4.5.2_build_8848:r4","noFixRecorded":false,"fixedIn":null},{"text":"5.0.0_build_13124","noFixRecorded":false,"fixedIn":null},{"text":"5.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"3.2.1:patch1 | 3.4 | 4.0 | 4.0.1 | 4.0.2 | 4.5.2 | 4.5.2_build_8848:r4 | 5.0.0_build_13124 | 5.5","eol":null,"hubHref":"/vendor/vmware/workstation"}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://secunia.com/advisories/18344","label":"secunia.com/advisories/18344","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://securityreason.com/securityalert/282","label":"securityreason.com/securityalert/282","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]},{"url":"http://www.vupen.com/english/advisories/2005/3013","label":"www.vupen.com/english/advisories/2005/3013","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN","URL Repurposed"]},{"url":"http://secunia.com/advisories/18162","label":"secunia.com/advisories/18162","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Patch","Vendor Advisory"]},{"url":"http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=2000","label":"www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=2000","hostname":"www.vmware.com","tags":["X Refsource CONFIRM","Patch","Broken Link"]},{"url":"http://www.gentoo.org/security/en/glsa/glsa-200601-04.xml","label":"www.gentoo.org/security/en/glsa/glsa-200601-04.xml","hostname":"www.gentoo.org","tags":["Vendor Advisory","X Refsource GENTOO","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/15998","label":"www.securityfocus.com/bid/15998","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Patch","Broken Link"]},{"url":"http://securitytracker.com/id?1015401","label":"securitytracker.com/id?1015401","hostname":"securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK","Permissions Required"]},{"url":"http://lists.grok.org.uk/pipermail/full-disclosure/2005-December/040442.html","label":"lists.grok.org.uk/pipermail/full-disclosure/2005-December/040442.html","hostname":"lists.grok.org.uk","tags":["Mailing List","X Refsource FULLDISC","Exploit"]},{"url":"http://www.kb.cert.org/vuls/id/856689","label":"www.kb.cert.org/vuls/id/856689","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"http://www.securityfocus.com/archive/1/419997/100/0/threaded","label":"www.securityfocus.com/archive/1/419997/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ","Broken Link"]},{"url":"http://www.securityfocus.com/archive/1/420017/100/0/threaded","label":"www.securityfocus.com/archive/1/420017/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ","Broken Link"]},{"url":"http://securityreason.com/securityalert/289","label":"securityreason.com/securityalert/289","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2005-12-21T20:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T23:46:05.391Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":90,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T02:54:13.484Z","stale":false,"partial":false}}