what you don't know can hurt you

VMWare Player 7.1.3 DLL Hijacking

VMWare Player 7.1.3 DLL Hijacking
Posted Aug 2, 2018
Authored by Stefan Kanthak

VMWare Player version 7.1.3 suffers from a dll hijacking vulnerability.

tags | exploit
systems | windows
advisories | CVE-2016-7085
MD5 | 1fc470ced3a5495203d14e2c759426c0

VMWare Player 7.1.3 DLL Hijacking

Change Mirror Download
Hi @ll,

on February 13, 2016, I sent a vulnerability report regarding the
then current executable installer of VMware-player 7.1.3 to its
vendor.

On September 14, 2016, VMware published
<http://blogs.vmware.com/security/2016/09/vmsa-2016-0014.html> and
<http://www.vmware.com/security/advisories/VMSA-2016-0014.html>

I was NOT AMUSED that it took 7 month to fix this beginner's error.


In January 2018, VMware published VMware-player-12.5.9-7535481.exe,
available via <https://www.vmware.com/go/downloadplayer> from
<https://download3.vmware.com/software/player/file/VMware-player-12.5.9-7535481.exe>,
which shows this vulnerability again (plus THREE others), again
allowing arbitrary code execution WITH escalation of privilege!

Apparently VMware's developers haven't heard of regression tests
yet, and their QA (if they have one) seems sound asleep!


On a fully patched Windows 7 SP1, VMware-player-12.5.9-7535481.exe
loads CredSSP.dll, WSHTCPIP.dll, WSHIP6.dll and RASAdHlp.dll from
its "application directory", typically the user's "Downloads"
directory "%USERPROFILE%\Downloads", instead from Windows'
"system directory" "%SystemRoot%\System32".

For this well-known and well-documented vulnerability see
<https://cwe.mitre.org/data/definitions/426.html> and
<https://cwe.mitre.org/data/definitions/427.html> plus
<https://capec.mitre.org/data/definitions/471.html>.


The application manifest embedded in VMware-player-12.5.9-7535481.exe
specifies "requireAdministrator", so any (rogue) DLL placed by the
unprivileged user in the "Downloads" directory is executed with
administrative rights, resulting in arbitrary code execution WITH
escalation of privilege.

CVSS v3 Base Score: 8.2 (High) CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v2 Base Score: 7.8 AV:L/AC:M/Au:N/C:C/I:C/A:C


Demonstration/proof of concept:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1. follow the instructions from
<https://skanthak.homepage.t-online.de/minesweeper.html>
and build a minefield of 32-bit forwarder DLLs in your "Downloads"
directory;

2. download
<https://download3.vmware.com/software/player/file/VMware-player-12.5.9-7535481.exe>,
and save it in your "Downloads" directory;

3. execute VMware-player-12.5.9-7535481.exe: notice the message
boxes displayed from the DLLs built in step 1!


stay tuned (and FAR away from ALL executable installers!)
Stefan Kanthak


Timeline:
~~~~~~~~~

2018-06-03 vulnerability report(s) sent to vendor

2018-06-13 vendor acknowledged receipt:
"We will look into this and provide feedback in due course."

2018-06-14 vendor replies:
"It is my understanding that Workstation Player 12.x has
since reached end of general support (in February of 2018)
as per our Lifecycle Product Matrix
<https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/support/product-lifecycle-matrix.pdf>."

2018-08-01 report published

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2019

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    21 Files
  • 2
    Apr 2nd
    35 Files
  • 3
    Apr 3rd
    21 Files
  • 4
    Apr 4th
    16 Files
  • 5
    Apr 5th
    15 Files
  • 6
    Apr 6th
    1 Files
  • 7
    Apr 7th
    2 Files
  • 8
    Apr 8th
    23 Files
  • 9
    Apr 9th
    19 Files
  • 10
    Apr 10th
    15 Files
  • 11
    Apr 11th
    14 Files
  • 12
    Apr 12th
    11 Files
  • 13
    Apr 13th
    2 Files
  • 14
    Apr 14th
    5 Files
  • 15
    Apr 15th
    14 Files
  • 16
    Apr 16th
    19 Files
  • 17
    Apr 17th
    19 Files
  • 18
    Apr 18th
    8 Files
  • 19
    Apr 19th
    4 Files
  • 20
    Apr 20th
    5 Files
  • 21
    Apr 21st
    1 Files
  • 22
    Apr 22nd
    4 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2019 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close