CVE-2016-5330 Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Play...
HighCVSS 7.8
EPSS 19.5%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Untrusted search path vulnerability in the HGFS (aka Shared Folders) feature in VMware Tools 10.0.5 in VMware ESXi 5.0 through 6.0, VMware Workstation Pro 12.1.x before 12.1.1, VMware Workstation Player 12.1.x before 12.1.1, and VMware Fusion 8.1.x before 8.1.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| VMware workstation player | >= 12.1.0, < 12.1.1 | 12.1.1 |
| VMware workstation pro | >= 12.1.0, < 12.1.1 | 12.1.1 |
| VMware esxi | >= 5.0, <= 6.0 | No fix listed |
| VMware Fusion | >= 8.1, < 8.1.1 | 8.1.1 |
| VMware tools | >= 9.0.0, <= 10.3.22 | No fix listed |
References
- www.rapid7.com third-party-advisory
- 20160805 DLL side loading vulnerability in VMware Host Guest Client Redirector mailing-list third-party-advisory vdb-entry
- 92323 third-party-advisory vdb-entry
- 1036544 third-party-advisory vdb-entry
- 1036545 third-party-advisory vdb-entry
- 1036619 third-party-advisory vdb-entry
- www.vmware.com mitigation vendor-advisory
- securify.nl exploit third-party-advisory