PT-2013-3302 · Debian+1 · Debian+2

Publicado 2013-08-24 · Atualizado 2013-08-26 · CVE-2013-1662

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 8.x through 9.x VMware Player versions 4.x through 5.x

Description The issue allows host OS users to gain host OS privileges via a crafted lsb release binary in a directory in the PATH, related to the use of the popen library function. This is specifically relevant on systems based on Debian GNU/Linux.

Recommendations For VMware Workstation versions 8.x through 9.x, update to a version that includes a fix for this issue. For VMware Player versions 4.x through 5.x, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting the use of the popen library function or limiting access to the lsb release binary until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2013-1662

Produtos afetados

Debian

Vmware Player

Vmware Workstation

Referências · 7

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/vmware_mount.rb · Exploit
• 🔥 https://exploit-db.com/exploits/27938 · Exploit
• 🔥 https://exploit-db.com/exploits/40169 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-1662 · Nota de Segurança
• http://vmware.com/security/advisories/VMSA-2013-0010.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1662 · Nota
• http://blog.cmpxchg8b.com/2013/08/security-debianisms.html · Nota