PRIOn knowledge basePRION:CVE-2016-5330Design/Logic Flaw
Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Player 12.1.x before 12.1.1, and VMware Fusion 8.1.x before 8.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
| CPE | Name | Operator | Version |
|---|---|---|---|
| esxi | ge | 5.0 | |
| esxi | le | 6.0 | |
| fusion | ge | 8.1 | |
| fusion | lt | 8.1.1 | |
| tools | ge | 9.0.0 | |
| tools | le | 10.3.22 | |
| workstation_player | ge | 12.1.0 | |
| workstation_player | lt | 12.1.1 | |
| workstation_pro | ge | 12.1.0 | |
| workstation_pro | lt | 12.1.1 |
References
www.rapid7.com/db/modules/exploit/windows/misc/vmhgfs_webdav_dll_sideload
www.securityfocus.com/archive/1/539131/100/0/threaded
www.securityfocus.com/bid/92323
www.securitytracker.com/id/1036544
www.securitytracker.com/id/1036545
www.securitytracker.com/id/1036619
www.vmware.com/security/advisories/VMSA-2016-0010.html
securify.nl/advisory/SFY20151201/dll_side_loading_vulnerability_in_vmware_host_guest_client_redirector.html
Related
