CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:A/AC:L/Au:N/C:P/I:P/A:P
EPSS
Percentile
53.4%
The installed version of VMware Player 6.x running on the remote Windows host is prior to 6.0.2. It is, therefore, reportedly affected by a privilege escalation vulnerability.
A kernel NULL dereference flaw exists in VMware tools on Windows 8.1 guest hosts. An attacker could escalate his privileges on the guest host.
Note that successful exploitation of the vulnerability does not allow privilege escalation from the guest host to the host system.
#
# (C) Tenable Network Security, Inc.
#
include("compat.inc");
if (description)
{
script_id(74265);
script_version("1.6");
script_cvs_date("Date: 2019/11/26");
script_cve_id("CVE-2014-3793");
script_bugtraq_id(67737);
script_xref(name:"VMSA", value:"2014-0005");
script_name(english:"VMware Player 6.x < 6.0.2 Windows 8.1 Guest Privilege Escalation (VMSA-2014-0005)");
script_summary(english:"Checks VMware Player version");
script_set_attribute(attribute:"synopsis", value:
"The remote host contains software that is affected by a privilege
escalation vulnerability.");
script_set_attribute(attribute:"description", value:
"The installed version of VMware Player 6.x running on the remote
Windows host is prior to 6.0.2. It is, therefore, reportedly affected
by a privilege escalation vulnerability.
A kernel NULL dereference flaw exists in VMware tools on Windows 8.1
guest hosts. An attacker could escalate his privileges on the guest
host.
Note that successful exploitation of the vulnerability does not allow
privilege escalation from the guest host to the host system.");
# https://www.vmware.com/support/player60/doc/player-602-release-notes.html
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?7df547df");
script_set_attribute(attribute:"solution", value:
"Upgrade to VMware Player 6.0.2 or later.");
script_set_cvss_base_vector("CVSS2#AV:A/AC:L/Au:N/C:P/I:P/A:P");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2014-3793");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2014/05/29");
script_set_attribute(attribute:"patch_publication_date", value:"2014/04/17");
script_set_attribute(attribute:"plugin_publication_date", value:"2014/06/02");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:player");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows");
script_copyright(english:"This script is Copyright (C) 2014-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("vmware_player_detect.nasl");
script_require_keys("SMB/Registry/Enumerated", "VMware/Player/Path", "VMware/Player/Version");
exit(0);
}
include("audit.inc");
include("global_settings.inc");
include("misc_func.inc");
get_kb_item_or_exit("SMB/Registry/Enumerated");
version = get_kb_item_or_exit("VMware/Player/Version");
path = get_kb_item_or_exit("VMware/Player/Path");
fixed = '6.0.2';
if (
ver_compare(ver:version, fix:'6.0.0', strict:FALSE) >= 0 &&
ver_compare(ver:version, fix:fixed, strict:FALSE) == -1
)
{
port = get_kb_item("SMB/transport");
if (!port) port = 445;
if (report_verbosity > 0)
{
report +=
'\n Path : ' + path +
'\n Installed version : ' + version +
'\n Fixed version : ' + fixed +
'\n';
security_warning(port:port, extra:report);
}
else security_warning(port);
}
else audit(AUDIT_INST_PATH_NOT_VULN, "VMware Player", version, path);