CVE-2013-1662

Related Files

VMWare Setuid vmware-mount Unsafe popen(3)

Posted Aug 29, 2013

Authored by Tavis Ormandy, egypt | Site metasploit.com

VMWare Workstation (up to and including 9.0.2 build-1031769) and Player have a setuid executable called vmware-mount that invokes lsb_release in the PATH with popen(3). Since PATH is user-controlled, and the default system shell on Debian-derived distributions does not drop privs, we can put an arbitrary payload in an executable called lsb_release and have vmware-mount happily execute it as root for us.

tags | exploit, arbitrary, shell, root

systems | linux, debian

advisories | CVE-2013-1662, OSVDB-96588

SHA-256 | d6d99d5e820653afe8fadb60e5b5067b276b612b74c995ebca5507a7c34190b3

Download | Favorite | View

VMware Security Advisory 2013-0010

Posted Aug 23, 2013

Authored by VMware | Site vmware.com

VMware Security Advisory 2013-0010 - VMware Workstation and VMware Player address a vulnerability in the vmware-mount component which could result in a privilege escalation on linux-based host machines.

tags | advisory

systems | linux

advisories | CVE-2013-1662

SHA-256 | 75310092496198f08a5f8a13a612852a0938bbfbb7b8f5a1b4e025180516c7f1

Download | Favorite | View