Lucene search

VmwareCVE-2020-3957

HistoryMay 29, 2020 - 8:15 p.m.

CVE-2020-3957

2020-05-2920:15:11

CWE-367

vmware

web.nvd.nist.gov

cve-2020-3957

vmware

fusion

remote console

horizon client

privilege escalation

local vulnerability

toctou issue

nvd

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

5.1%

JSON

VMware Fusion (11.x before 11.5.5), VMware Remote Console for Mac (11.x and prior) and VMware Horizon Client for Mac (5.x and prior) contain a local privilege escalation vulnerability due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to root on the system where Fusion, VMRC and Horizon Client are installed.

Affected configurations

Nvd

Node

applemacosMatch-

AND

vmwarefusionRange11.0.0–11.5.5

vmwarehorizon_clientRange≤5.4.0

vmwareremote_consoleRange≤11.0.1

VendorProductVersionCPE
applemacos-cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*
vmwarefusion*cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*
vmwarehorizon_client*cpe:2.3:a:vmware:horizon_client:*:*:*:*:*:*:*:*
vmwareremote_console*cpe:2.3:a:vmware:remote_console:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
apple	macos	-	cpe:2.3:o:apple:macos:-:::::::*
vmware	fusion	*	cpe:2.3:a:vmware:fusion::::::::
vmware	horizon_client	*	cpe:2.3:a:vmware:horizon_client::::::::
vmware	remote_console	*	cpe:2.3:a:vmware:remote_console::::::::

CNA Affected

[
  {
    "product": "VMware Fusion",
    "vendor": "VMware",
    "versions": [
      {
        "status": "affected",
        "version": "11.x before 11.5.5"
      }
    ]
  },
  {
    "product": "VMware Remote Console for Mac",
    "vendor": "VMware",
    "versions": [
      {
        "status": "affected",
        "version": "V11.x and prior"
      }
    ]
  },
  {
    "product": "VMware Horizon Client for Mac",
    "vendor": "VMware",
    "versions": [
      {
        "status": "affected",
        "version": "5.x and prior"
      }
    ]
  }
]

References

www.vmware.com/security/advisories/VMSA-2020-0011.html

CVSS2

6.9

Attack Vector

LOCAL

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:M/Au:N/C:C/I:C/A:C

CVSS3

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.1

Confidence

High

EPSS

Percentile

5.1%

JSON

Related for CVE-2020-3957