Unquoted Windows search path vulnerability in the Authorization and other services in VMware Player 1.0.x before 1.0.5 and 2.0 before 2.0.1, VMware Server before 1.0.4, and Workstation 5.x before 5.5.5 and 6.x before 6.0.1 might allow local users to gain privileges via malicious programs.

VMware products installed on the remote host are affected by multiple vulnerabilities :

  - The 'authd' process is affected by a privilege     escalation vulnerability that could allow an attacker to     execute arbitrary code with system level privileges or     cause a denial of service condition.

  - A feature in VMware workstation version 6.0.2 could     allow anonymous console access to guest host via VIX     API, which could result in unauthorized access. This     feature has been disabled in version 6.0.3.

  - Windows based VMware hosts are affected by a privilege     escalation vulnerability. By manipulating 'config.ini'     an attacker may be able to gain elevated privileges by     hijacking the VMware VMX process.

  - Multiple VMware products are affected by a directory     traversal vulnerability. If a Windows based VMware host     is configured to allow shared access from a guest host     to a folder on the Host system (HGFS), it may be     possible     to gain access to the Host file system from guest OS and     create/modify arbitrary executable files. VMware Server     is not affected by this vulnerability.

  - Multiple VMware products hosted on a Windows 2000 host     are affected by a privilege escalation vulnerability.

  - Multiple VMware products are vulnerable to a potential     denial of service attack.

Neel Mehta and Ryan Smith discovered that the VMware Player DHCP server did not correctly handle certain packet structures. Remote attackers could send specially crafted packets and gain root privileges. (CVE-2007-0061, CVE-2007-0062, CVE-2007-0063)

Rafal Wojtczvk discovered multiple memory corruption issues in VMware Player. Attackers with administrative privileges in a guest operating system could cause a denial of service or possibly execute arbitrary code on the host operating system. (CVE-2007-4496, CVE-2007-4497).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
31729	VMware Products Multiple Vulnerabilities (VMSA-2008-0005)	Nessus	Windows	high
28250	Ubuntu 6.06 LTS / 6.10 / 7.04 : linux-restricted-modules-2.6.17/20, vmware-player-kernel-2.6.15 vulnerabilities (USN-543-1)	Nessus	Ubuntu Local Security Checks	critical

Detections

Analytics

CVE-2007-5618

high

Tenable Plugins

high

critical