VMware 'vmrun' on Linux Local Privilege Escalation Vulnerability

Bugtraq ID:	47094
Class:	Design Error
CVE:	CVE-2011-1126
Remote:	No
Local:	Yes
Published:	Mar 30 2011 12:00AM
Updated:	Mar 30 2011 12:00AM
Credit:	Tim Brown
Vulnerable:	VMWare Workstation 7.1.2 build 301548 VMWare Workstation 7.1.1 VMWare Workstation 7.0.1 VMWare Workstation 6.5.5 VMWare Workstation 6.5.3 VMWare Workstation 6.5.2 VMWare Workstation 6.5.1 VMWare Workstation 6.5 build 118166 VMWare Workstation 7.13 VMWare Workstation 7.1.2 Build 301548 VMWare Workstation 7.1.2 VMWare Workstation 7.1 VMWare Workstation 7.0.1 build 227600 VMWare Workstation 7.0 VMWare Workstation 6.5.5 build 328052 VMWare Workstation 6.5.5 VMWare Workstation 6.5.4 build 246459 VMWare Workstation 6.5.4 VMWare Workstation 6.5.3 build 185404 VMWare Workstation 6.5.2 build 156735 VMWare VIX API 1.1.4 VMWare VIX API 1.1.3 VMWare VIX API 1.1.2 VMWare VIX API 1.1.1 VMWare VIX API 1.1 VMWare VIX API 1.7 VMWare VIX API 1.6 VMWare VIX API 1.10.2
Not Vulnerable:	VMWare Workstation 7.1.4 Build 385536

VMware 'vmrun' on Linux Local Privilege Escalation Vulnerability

VMware VIX API and Workstation on Linux are prone to a local privilege-escalation vulnerability that affects the 'vmrun' utility.

Local attackers can exploit this issue to execute arbitrary code with privileges of the 'vmrun' utility.

VMware 'vmrun' on Linux Local Privilege Escalation Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected]

VMware 'vmrun' on Linux Local Privilege Escalation Vulnerability

Solution:
The vendor has released an advisory and patches. Please see the references for more information.

VMware 'vmrun' on Linux Local Privilege Escalation Vulnerability

References:

• VMware Homepage (VMware)
  
• MSA-2011-0006 VMware vmrun utility local privilege escalation (VMware Security Team)