VMware GSX Server 2.5.1 build 4968 and earlier, and Workstation 4.0 and earlier, allows local users to gain root privileges via certain enivronment variables that are used when launching a virtual machine session.
https://euvd.enisa.europa.eu/vulnerability/EUVD-2003-0625
http://www.vmware.com/support/kb/enduser/std_adp.php?p_faqid=1039