JVN#88252465: Arbitrary files may be overwritten in multiple VMware products

Multiple products provided by VMware Inc. contain a vulnerability where arbitrary files on the host OS may be overwritten.

Impact

A user that can modify the configuration file for the virtual machine may overwrite arbitrary files on the host OS. As a result, privileges may be escalated in the host OS.

Solution

Update the software
Apply the appropriate update according to the information provided by the developer.

Products Affected

• VMware Workstation versions prior to 10.0.5
• VMware Player versions prior to 6.0.5
• VMware Fusion versions prior 6.0.5
• VMware ESXi 5.5 without patch ESXi550-201403102-SG
• VMware ESXi 5.1 without patch ESXi510-201404101-SG
• VMware ESXi 5.0 without patch ESXi500-201405101-SG