CVE-2009-3281

2022-10-0316:23:56

CWE-264

[email protected]

web.nvd.nist.gov

cve-2009-3281

vmware fusion

privilege escalation

file permissions

nvd

7.2 High

CVSS2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

6.4 Medium

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

23.3%

JSON

The vmx86 kernel extension in VMware Fusion before 2.0.6 build 196839 does not use correct file permissions, which allows host OS users to gain privileges on the host OS via unspecified vectors.

Affected configurations

NVD

Node

vmwarefusionRange≤2.0.5

vmwarefusionMatch1.0

vmwarefusionMatch1.1

vmwarefusionMatch1.1.1

vmwarefusionMatch1.1.2

vmwarefusionMatch1.1.3

vmwarefusionMatch2.0

vmwarefusionMatch2.0.1

vmwarefusionMatch2.0.2

vmwarefusionMatch2.0.3

vmwarefusionMatch2.0.4

AND

applemac_os_x

CPENameOperatorVersion
vmware:fusionvmware fusionle2.0.5
vmware:fusionvmware fusioneq1.0
vmware:fusionvmware fusioneq1.1
vmware:fusionvmware fusioneq1.1.1
vmware:fusionvmware fusioneq1.1.2
vmware:fusionvmware fusioneq1.1.3
vmware:fusionvmware fusioneq2.0
vmware:fusionvmware fusioneq2.0.1
vmware:fusionvmware fusioneq2.0.2
vmware:fusionvmware fusioneq2.0.3

CPE	Name	Operator	Version
vmware:fusion	vmware fusion	le	2.0.5
vmware:fusion	vmware fusion	eq	1.0
vmware:fusion	vmware fusion	eq	1.1
vmware:fusion	vmware fusion	eq	1.1.1
vmware:fusion	vmware fusion	eq	1.1.2
vmware:fusion	vmware fusion	eq	1.1.3
vmware:fusion	vmware fusion	eq	2.0
vmware:fusion	vmware fusion	eq	2.0.1
vmware:fusion	vmware fusion	eq	2.0.2
vmware:fusion	vmware fusion	eq	2.0.3