CVE-2008-0967
Summary
| CVE | CVE-2008-0967 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2008-06-05 20:32:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Untrusted search path vulnerability in vmware-authd in VMware Workstation 5.x before 5.5.7 build 91707 and 6.x before 6.0.4 build 93057, VMware Player 1.x before 1.0.7 build 91707 and 2.x before 2.0.4 build 93057, and VMware Server before 1.0.6 build 91891 on Linux, and VMware ESXi 3.5 and VMware ESX 2.5.4 through 3.5, allows local users to gain privileges via a library path option in a configuration file. |
Risk And Classification
Primary CVSS: v2.0 6.9 from [email protected]
AV:L/AC:M/Au:N/C:C/I:C/A:C
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
MediumAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:L/AC:M/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Vmware | Esx | 3.0.0 | All | All | All |
| Operating System | Vmware | Esx | 3.0.1 | All | All | All |
| Operating System | Vmware | Esx | 3.0.2 | All | All | All |
| Application | Vmware | Esxi | 3.5 | All | All | All |
| Application | Vmware | Esx Server | 2.5.5 | All | All | All |
| Application | Vmware | Esx Server | 3.1 | All | All | All |
| Application | Vmware | Esx Server | 3.2 | All | All | All |
| Application | Vmware | Esx Server | 3.3 | All | All | All |
| Application | Vmware | Esx Server | 3.5 | All | All | All |
| Application | Vmware | Player | 1.0.0 | All | All | All |
| Application | Vmware | Player | 1.0.1 | All | All | All |
| Application | Vmware | Player | 1.0.2 | All | All | All |
| Application | Vmware | Player | 1.0.3 | All | All | All |
| Application | Vmware | Player | 1.0.4 | All | All | All |
| Application | Vmware | Player | 1.0.5 | All | All | All |
| Application | Vmware | Player | 1.0.6 | All | All | All |
| Application | Vmware | Player | 2.0 | All | All | All |
| Application | Vmware | Player | 2.0.1 | All | All | All |
| Application | Vmware | Player | 2.0.2 | All | All | All |
| Application | Vmware | Player | 2.0.3 | All | All | All |
| Application | Vmware | Server | 1.0.3 | All | All | All |
| Application | Vmware | Vmware Server | 1.0.0 | All | All | All |
| Application | Vmware | Vmware Server | 1.0.1 | All | All | All |
| Application | Vmware | Vmware Server | 1.0.2 | All | All | All |
| Application | Vmware | Vmware Server | 1.0.4 | All | All | All |
| Application | Vmware | Vmware Server | 1.0.5 | All | All | All |
| Application | Vmware | Vmware Workstation | 5.5.0 | All | All | All |
| Application | Vmware | Vmware Workstation | 5.5.2 | All | All | All |
| Application | Vmware | Vmware Workstation | 5.5.5 | All | All | All |
| Application | Vmware | Vmware Workstation | 5.5.6 | All | All | All |
| Application | Vmware | Vmware Workstation | 6.0.1 | All | All | All |
| Application | Vmware | Vmware Workstation | 6.0.2 | All | All | All |
| Application | Vmware | Vmware Workstation | 6.0.3 | All | All | All |
| Application | Vmware | Workstation | 5.5.1 | All | All | All |
| Application | Vmware | Workstation | 5.5.3 | All | All | All |
| Application | Vmware | Workstation | 5.5.4 | All | All | All |
| Application | Vmware | Workstation | 6.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| VMware Products Multiple Vulnerabilities - Advisories - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| SecurityFocus | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| SecurityReason - Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi | af854a3a-2127-422b-91ae-364da2661108 | securityreason.com | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| Gentoo Linux Documentation -- VMware Player, Server, Workstation: Multiple vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| VMSA-2008-0009.2 - VMware | af854a3a-2127-422b-91ae-364da2661108 | www.vmware.com | Vendor Advisory |
| VMware Unsafe Library Path in vmware-authd Lets Local Users Gain Elevated Privileges - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | securitytracker.com | |
| VMware vmware-authd Daemon Local Privilege Escalation Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| labs.idefense.com/intelligence/vulnerabilities/display.php | af854a3a-2127-422b-91ae-364da2661108 | labs.idefense.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.