PT-2010-5404 · Vmware · Vmware Player+3

Published 2010-12-06 · Updated 2022-12-14 · CVE-2010-4296

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 7.0 through 7.1.2 build 301547 VMware Player versions 3.1.x through 3.1.1 build 301547 VMware Server version 2.0.2 VMware Fusion versions 3.1.x through 3.1.1 build 332100

Description The issue is related to the improper loading of libraries by vmware-mount, which can be exploited by host OS users to gain privileges. This is achieved through vectors involving shared object files.

Recommendations For VMware Workstation versions 7.0 through 7.1.2 build 301547, update to build 301548 or later. For VMware Player versions 3.1.x through 3.1.1 build 301547, update to build 301548 or later. For VMware Server version 2.0.2, update to a version that includes the fix for this issue. For VMware Fusion versions 3.1.x through 3.1.1 build 332100, update to build 332101 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2010-4296

Affected Products

Vmware Fusion

Vmware Player

Vmware Server

Vmware Workstation

References · 12

• http://vmware.com/security/advisories/VMSA-2010-0018.html · Vendor Advisory
• http://secunia.com/advisories/42482 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-4296 · Security Note
• http://secunia.com/advisories/42453 · Vendor Advisory
• http://lists.vmware.com/pipermail/security-announce/2010/000112.html · Vendor Advisory
• http://securityfocus.com/archive/1/514995/100/0/threaded · Note
• http://vupen.com/english/advisories/2010/3116 · Note
• http://osvdb.org/69584 · Note
• http://securitytracker.com/id?1024819 · Note
• http://securityfocus.com/bid/45168 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4296 · Note
• http://securitytracker.com/id?1024820 · Note