CVE-2010-4297
published 2010-12-06CVE-2010-4297: The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5…
PriorityP340high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
5.17%
91.5th percentile
The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5, 4.0, and 4.1; and VMware ESX 3.0.3, 3.5, 4.0, and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a "command injection" issue.
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esx | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | esxi | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | fusion | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
| vmware | player | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vrqj-4f32-p884: The VMware Tools update functionality in VMware Workstation 6
ghsa_unreviewed·2022-05-14
CVE-2010-4297 [HIGH] CWE-20 GHSA-vrqj-4f32-p884: The VMware Tools update functionality in VMware Workstation 6
The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5, 4.0, and 4.1; and VMware ESX 3.0.3, 3.5, 4.0, and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a "command injection" issue.
VMware
VMware hosted products and ESX patches resolve multiple security issues
vendor_vmware·2010-12-02·CVSS 6.9
CVE-2010-4294 [MEDIUM] VMware hosted products and ESX patches resolve multiple security issues
VMSA-2010-0018: VMware hosted products and ESX patches resolve multiple security issues
a. VMware Workstation, Player and Fusion vmware-mount race condition The way temporary files are handled by the mounting process could result in a race condition. This issue could allow a local user on the host to elevate their privileges. VMware Workstation and Player running on Microsoft Windows are not affected. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2010-4295 to this issue . VMware would like to thank Dan Rosenberg for reporting this issue. The following table lists what action remediates the vulnerability (column 4) if a solution is available. VMware Product ============= Product Version ======== Running On ======= Replace with Apply Path =======
No detection rules found.
No writeups or analysis indexed.
http://lists.vmware.com/pipermail/security-announce/2010/000112.htmlhttp://osvdb.org/69590http://secunia.com/advisories/42480http://secunia.com/advisories/42482http://www.securityfocus.com/archive/1/514995/100/0/threadedhttp://www.securityfocus.com/bid/45166http://www.securitytracker.com/id?1024819http://www.securitytracker.com/id?1024820http://www.vmware.com/security/advisories/VMSA-2010-0018.htmlhttp://www.vupen.com/english/advisories/2010/3116http://lists.vmware.com/pipermail/security-announce/2010/000112.htmlhttp://osvdb.org/69590http://secunia.com/advisories/42480http://secunia.com/advisories/42482http://www.securityfocus.com/archive/1/514995/100/0/threadedhttp://www.securityfocus.com/bid/45166http://www.securitytracker.com/id?1024819http://www.securitytracker.com/id?1024820http://www.vmware.com/security/advisories/VMSA-2010-0018.htmlhttp://www.vupen.com/english/advisories/2010/3116
2010-12-06
Published