high7.2Public exploit code

CVE-2010-4297

The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

VMware Tools - Update OS Command Injection2010-12-09 · remote · multiple

Impact

The VMware Tools update functionality in VMware Workstation 6.5.x before 6.5.5 build 328052 and 7.x before 7.1.2 build 301548; VMware Player 2.5.x before 2.5.5 build 328052 and 3.1.x before 3.1.2 build 301548; VMware Server 2.0.2; VMware Fusion 2.x before 2.0.8 build 328035 and 3.1.x before 3.1.2 build 332101; VMware ESXi 3.5, 4.0, and 4.1; and VMware ESX 3.0.3, 3.5, 4.0, and 4.1 allows host OS users to gain privileges on the guest OS via unspecified vectors, related to a "command injection" issue.

Affected products

Vendor	Product	Affected versions
Vmware	Workstation	Versions 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.5, 7.0
Vmware	Player	Versions 2.5, 2.5.1, 2.5.2, 2.5.3, 2.5.4, 2.5.5
Vmware	Fusion	Versions 2.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5
Vmware	Esxi	Versions 3.5, 4.0, 4.1
Vmware	Esx	Versions 3.5, 4.0, 4.1

Weakness classification

CWE-20

Public exploit code

Impact

Affected products

Weakness classification

References