PT-2014-5732 · Vmware · Vmware Tools+1

Published 2014-08-28 · Updated 2017-08-29 · CVE-2014-4200

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware Tools versions prior to the version that fixes the issue in VMware Workstation through 10.0.3

Description The issue allows local users to obtain sensitive information by extracting files from the vm-support archive due to the use of 0644 permissions.

Recommendations For versions prior to the fixed version, consider changing the permissions of the vm-support archive to prevent unauthorized access until a patch is available.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2014-4200

Affected Products

Vmware Tools

Vmware Workstation

References · 9

• 🔥 http://seclists.org/fulldisclosure/2014/Aug/71 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2014-4200 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-4200 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-4200 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-4200 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4200 · Note
• http://securityfocus.com/bid/69410 · Note
• http://securitytracker.com/id/1030758 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/95494 · Note