VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors.

The remote ESX/ESXi host is missing a security-related patch. It is, therefore, affected by a privilege escalation vulnerability due to the use of an incorrect Access Control List (ACL) for the VMware Tools folder. An adjacent attacker can exploit this to gain elevated privileges on Windows-based guest operating systems.

The remote VMware ESXi 5.0 host is affected by multiple vulnerabilities :

  - A denial of service vulnerability exists in the     big2_toUtf8() function in file lib/xmltok.c in the     libexpat library. A remote attacker can exploit this,     via an XML document having malformed UTF-8 sequences, to     cause a buffer over-read, thus crashing the application.
    (CVE-2009-3560)

  - A denial of service vulnerability exists in the     updatePosition() function in file lib/xmltok.c in the     libexpat library. A remote attacker can exploit this,     via an XML document having malformed UTF-8 sequences, to     cause a buffer over-read, thus crashing the application.
    (CVE-2009-3720)

  - An integer overflow condition exists in the     BZ2_decompress() function in file decompress.c in the     bzip2 and libbzip2 library. A remote attacker can     exploit this, via a crafted compressed file, to cause     a denial of service or the execution of arbitrary code.
    (CVE-2010-0405)

  - A denial of service vulnerability exists in the audioop     module due to multiple integer overflows conditions in     file audioop.c. A remote attacker can exploit this, via     a large fragment or argument, to cause a buffer     overflow, resulting in an application crash.
    (CVE-2010-1634)

  - A denial of service vulnerability exists in the audioop     module due to a failure to verify the relationships     between size arguments and byte string length. A remote     attacker can exploit this, via crafted arguments, to     cause memory corruption, resulting in an application     crash. (CVE-2010-2089)

  - A flaw exists in the urllib and urllib2 modules due to     processing Location headers that specify redirection to     a file. A remote attacker can exploit this, via a     crafted URL, to gain sensitive information or cause a     denial of service. (CVE-2011-1521)

  - A privilege escalation vulnerability exists due to an     incorrect ACL being used for the VMware Tools folder. An     attacker on an adjacent network with access to a guest     operating system can exploit this to gain elevated     privileges on the guest operating system.
    (CVE-2012-1518)

The VMware Workstation installation detected on the remote host is 8.x earlier than 8.0.2 and thus is potentially affected by a local privilege escalation vulnerability because the access control list of the VMware Tools folder is incorrectly set.

By exploiting this issue, a local attacker could elevate his privileges on Windows-based Guest Operating Systems.

The VMware Player installation detected on the remote host is 4.0.x earlier than 4.0.2 and thus is potentially affected by a local privilege escalation vulnerability because the access control list of the VMware Tools folder is incorrectly set. 

By exploiting this issue, a local attacker could elevate his privileges on Windows-based Guest Operating Systems.

The version of VMware Fusion 4.x installed on the Mac OS X host is earlier than 4.1.2.  As such, it is reportedly affected by a local privilege escalation vulnerability because the access control list of the VMware Tools folder is incorrectly set.

By exploiting this issue, a local attacker could elevate his privileges on Windows-based Guest Operating Systems.

a. VMware Tools Incorrect Folder Permissions Privilege Escalation

   The access control list of the VMware Tools folder is incorrectly    set. Exploitation of this issue may lead to local privilege    escalation on Windows-based Guest Operating Systems.

   VMware would like to thank Tavis Ormandy for reporting this issue    to us.

   The Common Vulnerabilities and Exposures project (cve.mitre.org)    has assigned the name CVE-2012-1518 to this issue.

ID	Name	Product	Family	Severity
89108	VMware ESX / ESXi Tools Folder Incorrect ACL Privilege Escalation (VMSA-2012-0007) (remote check)	Nessus	Misc.	high
70881	ESXi 5.0 < Build 608089 Multiple Vulnerabilities (remote check)	Nessus	Misc.	high
58794	VMware Products Local Privilege Escalation (VMSA-2012-0007)	Nessus	Windows	high
58793	VMware Player Local Privilege Escalation (VMSA-2012-0007)	Nessus	Windows	high
58792	VMware Fusion 4.x < 4.1.2 (VMSA-2012-0007)	Nessus	MacOS X Local Security Checks	high
58744	VMSA-2012-0007 : VMware hosted products and ESXi/ESX patches address privilege escalation	Nessus	VMware ESX Local Security Checks	high

Detections

Analytics

CVE-2012-1518

high

Tenable Plugins

high

high

high

high

high

high