Vulnerabilities > CVE-2016-7085 - Untrusted Search Path vulnerability in VMWare Workstation Player and Workstation PRO

047910
CVSS 7.2 - HIGH
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
low complexity
vmware
microsoft
CWE-426
nessus

Summary

Untrusted search path vulnerability in the installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows allows local users to gain privileges via a Trojan horse DLL in an unspecified directory.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Leveraging/Manipulating Configuration File Search Paths
    This attack loads a malicious resource into a program's standard path used to bootstrap and/or provide contextual information for a program like a path variable or classpath. J2EE applications and other component based applications that are built from multiple binaries can have very long list of dependencies to execute. If one of these libraries and/or references is controllable by the attacker then application controls can be circumvented by the attacker. A standard UNIX path looks similar to this If the attacker modifies the path variable to point to a locale that includes malicious resources then the user unwittingly can execute commands on the attackers' behalf: This is a form of usurping control of the program and the attack can be done on the classpath, database resources, or any other resources built from compound parts. At runtime detection and blocking of this attack is nearly impossible, because the configuration allows execution.

Nessus

  • NASL familyWindows
    NASL idVMWARE_WORKSTATION_MULTIPLE_VMSA_2016_0014.NASL
    descriptionThe version of VMware Workstation installed on the remote host is 12.x prior to 12.5.0. It is, therefore, affected by multiple vulnerabilities : - A heap buffer overflow condition exists in Cortado ThinPrint due to improper validation of user-supplied input. An attacker on the guest can exploit this to cause a denial of service condition or the execution of arbitrary code on the host system. (CVE-2016-7081) - A memory corruption issue exists in Cortado Thinprint due to improper handling of specially crafted EMF files. An attacker on the guest can exploit this to cause a denial of service condition or the execution of arbitrary code on the host system. (CVE-2016-7082) - A memory corruption issue exists in Cortado Thinprint due to improper handling of TrueType fonts embedded in EMFSPOOL. An attacker on the guest can exploit this to cause a denial of service condition or the execution of arbitrary code on the host system. (CVE-2016-7083) - A memory corruption issue exists in Cortado Thinprint due to improper handling of specially crafted JPEG2000 images. An attacker on the guest can exploit this to cause a denial of service condition or the execution of arbitrary code on the host system. (CVE-2016-7084) - A flaw exits due to improper loading of some dynamic link library (DLL) files that allows an attacker to load a DLL file and thereby execute arbitrary code. (CVE-2016-7085) - A flaw exists in the Workstation installer due to insecure loading of executables. An attacker can exploit this, via a crafted application named
    last seen2020-06-01
    modified2020-06-02
    plugin id93521
    published2016-09-15
    reporterThis script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/93521
    titleVMware Workstation 12.x < 12.5.0 Multiple Vulnerabilities (VMSA-2016-0014)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(93521);
      script_version("1.8");
      script_cvs_date("Date: 2019/11/14");
    
      script_cve_id(
        "CVE-2016-7081",
        "CVE-2016-7082",
        "CVE-2016-7083",
        "CVE-2016-7084",
        "CVE-2016-7085",
        "CVE-2016-7086"
      );
      script_bugtraq_id(
        92934,
        92935,
        92940,
        92941
      );
      script_xref(name:"VMSA", value:"2016-0014");
    
      script_name(english:"VMware Workstation 12.x < 12.5.0 Multiple Vulnerabilities (VMSA-2016-0014)");
      script_summary(english:"Checks the VMware Workstation version.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A virtualization application installed on the remote host is affected
    by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of VMware Workstation installed on the remote host is
    12.x prior to 12.5.0. It is, therefore, affected by multiple
    vulnerabilities :
    
      - A heap buffer overflow condition exists in Cortado
        ThinPrint due to improper validation of user-supplied
        input. An attacker on the guest can exploit this to
        cause a denial of service condition or the execution of
        arbitrary code on the host system. (CVE-2016-7081)
    
      - A memory corruption issue exists in Cortado Thinprint
        due to improper handling of specially crafted EMF files.
        An attacker on the guest can exploit this to cause a
        denial of service condition or the execution of
        arbitrary code on the host system. (CVE-2016-7082)
    
      - A memory corruption issue exists in Cortado Thinprint
        due to improper handling of TrueType fonts embedded in
        EMFSPOOL. An attacker on the guest can exploit this to
        cause a denial of service condition or the execution of
        arbitrary code on the host system. (CVE-2016-7083)
    
      - A memory corruption issue exists in Cortado Thinprint
        due to improper handling of specially crafted JPEG2000
        images. An attacker on the guest can exploit this to
        cause a denial of service condition or the execution of
        arbitrary code on the host system. (CVE-2016-7084)
    
      - A flaw exits due to improper loading of some dynamic
        link library (DLL) files that allows an attacker to load
        a DLL file and thereby execute arbitrary code.
        (CVE-2016-7085)
    
      - A flaw exists in the Workstation installer due to
        insecure loading of executables. An attacker can exploit
        this, via a crafted application named 'setup64.exe'
        inserted into the same directory as the installer, to
        execute arbitrary code. (CVE-2016-7086)");
      script_set_attribute(attribute:"see_also", value:"https://www.vmware.com/security/advisories/VMSA-2016-0014.html");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to VMware Workstation 12.5.0 or later.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2016-7086");
    
      script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"true");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2016/09/13");
      script_set_attribute(attribute:"patch_publication_date", value:"2016/09/13");
      script_set_attribute(attribute:"plugin_publication_date", value:"2016/09/15");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:workstation");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2016-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("vmware_workstation_detect.nasl");
      script_require_keys("SMB/Registry/Enumerated", "installed_sw/VMware Workstation");
    
      exit(0);
    }
    
    include("audit.inc");
    include("global_settings.inc");
    include("install_func.inc");
    include("misc_func.inc");
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    
    appname = 'VMware Workstation';
    
    install = get_single_install(app_name:appname, exit_if_unknown_ver:TRUE);
    version = install['version'];
    path = install['path'];
    
    fix = "12.5.0";
    
    if (version =~ "^12\." && ver_compare(ver:version, fix:fix, strict:FALSE) < 0)
    {
      port = get_kb_item("SMB/transport");
      if (!port) port = 445;
    
      report =
        '\n  Path              : ' + path +
        '\n  Installed version : ' + version +
        '\n  Fixed version     : ' + fix + '\n';
      security_report_v4(port:port, extra:report, severity:SECURITY_HOLE);
    }
    else audit(AUDIT_INST_PATH_NOT_VULN, appname, version, path);
    
  • NASL familyVMware ESX Local Security Checks
    NASL idVMWARE_VMSA-2016-0014.NASL
    descriptiona. VMware Workstation heap-based buffer overflow vulnerabilities via Cortado ThinPrint VMware Workstation contains vulnerabilities that may allow a windows -based virtual machine (VM) to trigger heap-based buffer overflows in the windows-based hypervisor running VMware workstation that the VM resides on. Exploitation of this issue may lead to arbitrary code execution in the hypervisor OS. Exploitation is only possible if virtual printing has been enabled in VMware Workstation. This feature is not enabled by default. VMware Knowledge Base article 2146810 documents the procedure for enabling and disabling this feature. VMware would like to thank E0DB6391795D7F629B5077842E649393 working with Trend Micro
    last seen2020-06-01
    modified2020-06-02
    plugin id93512
    published2016-09-15
    reporterThis script is Copyright (C) 2016-2018 Tenable Network Security, Inc.
    sourcehttps://www.tenable.com/plugins/nessus/93512
    titleVMSA-2016-0014 : VMware ESXi, Workstation, Fusion, &amp; Tools updates address multiple security issues

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/148784/vmwareplayer713-dllhijack.txt
idPACKETSTORM:148784
last seen2018-08-04
published2018-08-02
reporterStefan Kanthak
sourcehttps://packetstormsecurity.com/files/148784/VMWare-Player-7.1.3-DLL-Hijacking.html
titleVMWare Player 7.1.3 DLL Hijacking