Executive Summary
| Summary | |
|---|---|
| Title | VMware hosted products and ESXi/ESX patches address privilege escalation |
| Informations | |||
|---|---|---|---|
| Name | VMSA-2012-0007 | First vendor Publication | 2012-04-12 |
| Vendor | VMware | Last vendor Modification | 2012-06-13 |
| Severity (Vendor) | N/A | Revision | 1 |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:A/AC:L/Au:N/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 8.3 | Attack Range | Adjacent network |
| Cvss Impact Score | 10 | Attack Complexity | Low |
| Cvss Expoit Score | 6.5 | Authentication | None Required |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| a. VMware Tools Incorrect Folder Permissions Privilege Escalation The access control list of the VMware Tools folder is incorrectly set. Exploitation of this issue may lead to local privilege escalation on Windows-based Guest Operating Systems. VMware would like to thank Tavis Ormandy for reporting this issue to us. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2012-1518 to this issue. |
Original Source
| Url : http://www.vmware.com/security/advisories/VMSA-2012-0007.html |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 100 % | CWE-264 | Permissions, Privileges, and Access Controls |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:16745 | |||
| Oval ID: | oval:org.mitre.oval:def:16745 | ||
| Title: | VMware hosted products address privilege escalation | ||
| Description: | VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors. | ||
| Family: | windows | Class: | vulnerability |
| Reference(s): | CVE-2012-1518 | Version: | 5 |
| Platform(s): | Microsoft Windows 7 Microsoft Windows Server 2003 Microsoft Windows Server 2008 Microsoft Windows Server 2008 R2 Microsoft Windows Vista Microsoft Windows XP | Product(s): | VMware Workstation VMware Player |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:20681 | |||
| Oval ID: | oval:org.mitre.oval:def:20681 | ||
| Title: | VMware hosted products and ESXi/ESX patches address privilege escalation | ||
| Description: | VMware Workstation 8.x before 8.0.2, VMware Player 4.x before 4.0.2, VMware Fusion 4.x before 4.1.2, VMware ESXi 3.5 through 5.0, and VMware ESX 3.5 through 4.1 use an incorrect ACL for the VMware Tools folder, which allows guest OS users to gain guest OS privileges via unspecified vectors. | ||
| Family: | unix | Class: | vulnerability |
| Reference(s): | CVE-2012-1518 | Version: | 5 |
| Platform(s): | VMWare ESX Server 4.1 VMWare ESX Server 4.0 VMWare ESX Server 3.5 | Product(s): | |
| Definition Synopsis: | |||
| |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-04-13 | Name : VMSA-2012-0007 VMware hosted products and ESX patches address privilege escal... File : nvt/gb_VMSA-2012-0007.nasl |
Information Assurance Vulnerability Management (IAVM)
| Date | Description |
|---|---|
| 2012-05-03 | IAVM : 2012-A-0071 - Multiple Vulnerabilities in VMware ESXi 3.5 and ESX 3.5 Severity : Category I - VMSKEY : V0032165 |
| 2012-05-03 | IAVM : 2012-A-0072 - Multiple Vulnerabilities in VMware ESXi 4.0 and ESX 4.0 Severity : Category I - VMSKEY : V0032167 |
| 2012-05-03 | IAVM : 2012-A-0073 - Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1 Severity : Category I - VMSKEY : V0032171 |
| 2012-05-03 | IAVM : 2012-A-0075 - Multiple Vulnerabilities in VMware Fusion Severity : Category I - VMSKEY : V0032174 |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2016-03-03 | Name : The remote VMware ESXi / ESX host is missing a security-related patch. File : vmware_VMSA-2012-0007_remote.nasl - Type : ACT_GATHER_INFO |
| 2013-11-13 | Name : The remote VMware ESXi 5.0 host is affected by multiple vulnerabilities. File : vmware_esxi_5_0_build_608089_remote.nasl - Type : ACT_GATHER_INFO |
| 2012-04-19 | Name : The remote host has a virtualization application affected by a local privileg... File : macosx_fusion_4_1_2.nasl - Type : ACT_GATHER_INFO |
| 2012-04-19 | Name : The remote host has a virtualization application affected by a local privileg... File : vmware_player_priv_esc_vmsa_2012_0007.nasl - Type : ACT_GATHER_INFO |
| 2012-04-19 | Name : The remote host has a virtualization application affected by a local privileg... File : vmware_workstation_priv_esc_vmsa_2012_0007.nasl - Type : ACT_GATHER_INFO |
| 2012-04-13 | Name : The remote VMware ESXi / ESX host is missing a security-related patch. File : vmware_VMSA-2012-0007.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2016-03-04 13:26:25 |
|
| 2015-12-24 13:25:54 |
|
| 2014-02-17 12:07:23 |
|
| 2013-11-11 12:41:41 |
|
