PT-2016-6367 · Vmware · Vmware Tools+4

Yorick Koster · Published 2016-08-08 · Updated 2021-11-05 · CVE-2016-5330

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 5.0 through 6.0 VMware Tools version 10.0.5 VMware Workstation Pro versions 12.1.x before 12.1.1 VMware Workstation Player versions 12.1.x before 12.1.1 VMware Fusion versions 8.1.x before 8.1.1

Description The issue allows local users to gain privileges via a Trojan horse DLL in the current working directory, due to an untrusted search path vulnerability in the HGFS feature.

Recommendations For VMware ESXi versions 5.0 through 6.0, update to a version outside of the affected range. For VMware Tools version 10.0.5, update to a version outside of the affected range. For VMware Workstation Pro versions 12.1.x before 12.1.1, update to version 12.1.1 or later. For VMware Workstation Player versions 12.1.x before 12.1.1, update to version 12.1.1 or later. For VMware Fusion versions 8.1.x before 8.1.1, update to version 8.1.1 or later.

Exploit

Fix

Untrusted Search Path

Weakness Enumeration

CWE-426

Related Identifiers

CVE-2016-5330

Affected Products

Vmware Esxi

Vmware Fusion

Vmware Tools

Vmware Workstation

Vmware Workstation Player

References · 13

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/misc/vmhgfs_webdav_dll_sideload.rb · Exploit
• 🔥 https://securify.nl/advisory/SFY20151201/dll_side_loading_vulnerability_in_vmware_host_guest_client_redirector.html · Exploit
• 🔥 https://exploit-db.com/exploits/41711 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2016-5330 · Security Note
• http://vmware.com/security/advisories/VMSA-2016-0010.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-5330 · Vendor Advisory
• http://securityfocus.com/bid/92323 · Note
• http://securitytracker.com/id/1036619 · Note
• http://securitytracker.com/id/1036545 · Note
• http://securityfocus.com/archive/1/539131/100/0/threaded · Note
• http://securitytracker.com/id/1036544 · Note
• http://rapid7.com/db/modules/exploit/windows/misc/vmhgfs_webdav_dll_sideload · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-5330 · Note