The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5, 4.0, and 4.1; and VMware ESX 3.0.3, 3.5, 4.0, and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a "command injection" issue.

The remote VMware ESX / ESXi host is missing a security-related patch.
It is, therefore, affected by an unspecified flaw in the Tools update functionality due to improper validation of user-supplied input. A local attacker with host operating system access can exploit this flaw to gain root privileges on the guess operating system.

The version of VMware Fusion installed on the Mac OS X host is earlier than 3.1.2.  Such versions are affected by three security issues :

  - A race condition in the mounting process in vmware-mount     in allows host OS users to gain privileges via vectors     involving temporary files. (CVE-2010-4295)

  - The VMware Tools update functionality allows host OS     users to gain privileges on the guest OS via unspecified     vectors, related to a 'command injection' issue.     (CVE-2010-4297)   
  - vmware-mount does not properly load libraries, which     allows host OS users to gain privileges via vectors     involving shared object files. (CVE-2010-4296)

The version of VMware Fusion installed on the Mac OS X host is earlier than 2.0.8.  The VMware Tools update functionality in such versions allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a 'command injection' issue.

A VMware product (Player, Workstation, Server, or Movie Decoder) detected on the remote host has one or more of the following vulnerabilities :

  - A vulnerability in VMware Tools update could allow     arbitrary code execution on non-Windows based guest     operating systems with root privileges. (CVE-2010-4297)

  - A vulnerability in VMware VMnc Codec could allow     arbitrary code execution subject to the privileges     of the user running the application using the     vulnerable codec. (CVE-2010-4294)

In addition to patching, VMware Tools must be manually updated on all guest VMs in order to completely mitigate certain vulnerabilities. Refer to the VMware advisory for more information.

a. VMware Workstation, Player and Fusion vmware-mount race condition

   The way temporary files are handled by the mounting process could    result in a race condition. This issue could allow a local user on    the host to elevate their privileges.

   VMware Workstation and Player running on Microsoft Windows are not    affected.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-4295 to this issue.

   VMware would like to thank Dan Rosenberg for reporting this issue.

b. VMware Workstation, Player and Fusion vmware-mount privilege    escalation

   vmware-mount which is a suid binary has a flaw in the way libraries    are loaded.  This issue could allow local users on the host to    execute arbitrary shared object files with root privileges.

   VMware Workstation and Player running on Microsoft Windows are not    affected.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-4296 to this issue.

   VMware would like to thank Martin Carpenter for reporting this    issue.

c. OS Command Injection in VMware Tools update

   A vulnerability in the input validation of VMware Tools update    allows for injection of commands. The issue could allow a  user    on the host to execute commands on the guest operating system    with root privileges.

   The issue can only be exploited if VMware Tools is not fully    up-to-date.  Windows-based virtual machines are not affected.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-4297 to this issue.

   VMware would like to thank Nahuel Grisolia of Bonsai Information    Security, http://www.bonsai-sec.com, for reporting this issue.

d. VMware VMnc Codec frame decompression remote code execution

   The VMware movie decoder contains the VMnc media codec that is    required to play back movies recorded with VMware Workstation,    VMware Player and VMware ACE, in any compatible media player. The    movie decoder is installed as part of VMware Workstation, VMware    Player and VMware ACE, or can be downloaded as a stand alone    package.

   A function in the decoder frame decompression routine implicitly    trusts a size value.  An attacker can utilize this to miscalculate    a destination pointer, leading to the corruption of a heap buffer,    and could allow for execution of arbitrary code with the privileges    of the user running an application utilizing the vulnerable codec.

   For an attack to be successful the user must be tricked into    visiting a malicious web page or opening a malicious video file on    a system that has the vulnerable version of the VMnc codec installed.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2010-4294 to this issue.

   VMware would like to thank Aaron Portnoy and Logan Brown of    TippingPoint DVLabs for reporting this issue.

ID	Name	Product	Family	Severity
89744	VMware ESX / ESXi Tools Update Privilege Escalation (VMSA-2010-0018) (remote check)	Nessus	VMware ESX Local Security Checks	high
51079	VMware Fusion < 3.1.2 (VMSA-2010-0018)	Nessus	MacOS X Local Security Checks	high
51078	VMware Fusion < 2.0.8 (VMSA-2010-0018)	Nessus	MacOS X Local Security Checks	high
51057	VMware Products Multiple Vulnerabilities (VMSA-2010-0018)	Nessus	Windows	high
50985	VMSA-2010-0018 : VMware hosted products and ESX patches resolve multiple security issues	Nessus	VMware ESX Local Security Checks	high

Detections

Analytics

CVE-2010-4297

critical

Tenable Plugins

high

high

high

high

high