Vulnerabilities > CVE-2010-4296 - Incorrect Authorization vulnerability in VMWare products
Attack vector
UNKNOWN Attack complexity
UNKNOWN Privileges required
UNKNOWN Confidentiality impact
UNKNOWN Integrity impact
UNKNOWN Availability impact
UNKNOWN Summary
vmware-mount in VMware Workstation 7.x before 7.1.2 build 301548 on Linux, VMware Player 3.1.x before 3.1.2 build 301548 on Linux, VMware Server 2.0.2 on Linux, and VMware Fusion 3.1.x before 3.1.2 build 332101 does not properly load libraries, which allows host OS users to gain privileges via vectors involving shared object files.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 12 | |
| OS | 1 | |
| OS | 1 |
Common Weakness Enumeration (CWE)
Nessus
NASL family MacOS X Local Security Checks NASL id MACOSX_FUSION_3_1_2.NASL description The version of VMware Fusion installed on the Mac OS X host is earlier than 3.1.2. Such versions are affected by three security issues : - A race condition in the mounting process in vmware-mount in allows host OS users to gain privileges via vectors involving temporary files. (CVE-2010-4295) - The VMware Tools update functionality allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a last seen 2020-06-01 modified 2020-06-02 plugin id 51079 published 2010-12-08 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/51079 title VMware Fusion < 3.1.2 (VMSA-2010-0018) NASL family VMware ESX Local Security Checks NASL id VMWARE_VMSA-2010-0018.NASL description a. VMware Workstation, Player and Fusion vmware-mount race condition The way temporary files are handled by the mounting process could result in a race condition. This issue could allow a local user on the host to elevate their privileges. VMware Workstation and Player running on Microsoft Windows are not affected. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-4295 to this issue. VMware would like to thank Dan Rosenberg for reporting this issue. b. VMware Workstation, Player and Fusion vmware-mount privilege escalation vmware-mount which is a suid binary has a flaw in the way libraries are loaded. This issue could allow local users on the host to execute arbitrary shared object files with root privileges. VMware Workstation and Player running on Microsoft Windows are not affected. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-4296 to this issue. VMware would like to thank Martin Carpenter for reporting this issue. c. OS Command Injection in VMware Tools update A vulnerability in the input validation of VMware Tools update allows for injection of commands. The issue could allow a user on the host to execute commands on the guest operating system with root privileges. The issue can only be exploited if VMware Tools is not fully up-to-date. Windows-based virtual machines are not affected. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-4297 to this issue. VMware would like to thank Nahuel Grisolia of Bonsai Information Security, http://www.bonsai-sec.com, for reporting this issue. d. VMware VMnc Codec frame decompression remote code execution The VMware movie decoder contains the VMnc media codec that is required to play back movies recorded with VMware Workstation, VMware Player and VMware ACE, in any compatible media player. The movie decoder is installed as part of VMware Workstation, VMware Player and VMware ACE, or can be downloaded as a stand alone package. A function in the decoder frame decompression routine implicitly trusts a size value. An attacker can utilize this to miscalculate a destination pointer, leading to the corruption of a heap buffer, and could allow for execution of arbitrary code with the privileges of the user running an application utilizing the vulnerable codec. For an attack to be successful the user must be tricked into visiting a malicious web page or opening a malicious video file on a system that has the vulnerable version of the VMnc codec installed. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-4294 to this issue. VMware would like to thank Aaron Portnoy and Logan Brown of TippingPoint DVLabs for reporting this issue. last seen 2020-06-01 modified 2020-06-02 plugin id 50985 published 2010-12-06 reporter This script is Copyright (C) 2010-2019 Tenable Network Security, Inc. source https://www.tenable.com/plugins/nessus/50985 title VMSA-2010-0018 : VMware hosted products and ESX patches resolve multiple security issues
References
- http://lists.vmware.com/pipermail/security-announce/2010/000112.html
- http://www.vmware.com/security/advisories/VMSA-2010-0018.html
- http://secunia.com/advisories/42482
- http://www.securitytracker.com/id?1024820
- http://www.vupen.com/english/advisories/2010/3116
- http://secunia.com/advisories/42453
- http://www.securitytracker.com/id?1024819
- http://www.securityfocus.com/bid/45168
- http://osvdb.org/69584
- http://www.securityfocus.com/archive/1/514995/100/0/threaded