VMware Fusion Local Privilege Escalation Vulnerability

Bugtraq ID:	36578
Class:	Design Error
CVE:	CVE-2009-3281
Remote:	No
Local:	Yes
Published:	Oct 01 2009 12:00AM
Updated:	Oct 02 2009 07:40PM
Credit:	Neil Kettle
Vulnerable:	VMWare Fusion 2.0.5 VMWare Fusion 2.0.4 VMWare Fusion 2.0.3 VMWare Fusion 2.0.2 build 147997 VMWare Fusion 2
Not Vulnerable:	VMWare Fusion 2.0.6

VMware Fusion Local Privilege Escalation Vulnerability

VMware Fusion is prone to a privilege-escalation vulnerability caused by an unspecified file-permission problem.

An attacker can exploit this issue to run arbitrary code with superuser privileges. Successful attacks will completely compromise affected computers.

This issue affects versions prior to Fusion 2.0.6 build 196839.

VMware Fusion Local Privilege Escalation Vulnerability

An exploit is available.

• /data/vulnerabilities/exploits/36578.c

VMware Fusion Local Privilege Escalation Vulnerability

Solution:
The vendor has released an advisory and update. Please see the references for details.

VMware Fusion Local Privilege Escalation Vulnerability

References:

• VMware Homepage (VMware)
  
• Re: VMSA-2009-0013 VMware Fusion resolves two security issues (mu-b )
  
• VMSA-2009-0013 VMware Fusion resolves two security issues (VMware Security team )
  
• VMSA-2009-0013 VMware Fusion resolves two security issues (VMware)