Search...

VMware Workstation gdk-pixbuf Path Subversion Privilege Escalation

2005-02-14T12:42:19

ID OSVDB:13823
Type osvdb
Reporter OSVDB
Modified 2005-02-14T12:42:19

Description

No description provided by the source

References:

Vendor Specific Advisory URL Secunia Advisory ID:14291 Other Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200502-18.xml CVE-2005-0444

JSON Vulners Source

Initial Source

{"edition": 1, "title": "VMware Workstation gdk-pixbuf Path Subversion Privilege Escalation", "bulletinFamily": "software", "published": "2005-02-14T12:42:19", "lastseen": "2017-04-28T13:20:09", "modified": "2005-02-14T12:42:19", "reporter": "OSVDB", "viewCount": 1, "href": "https://vulners.com/osvdb/OSVDB:13823", "description": "# No description provided by the source\n\n## References:\n[Vendor Specific Advisory URL](http://www.vmware.com/support/kb/enduser/std_adp.php?p_sid=FsNALBWh&p_lva=&p_faqid=1588)\n[Secunia Advisory ID:14291](https://secuniaresearch.flexerasoftware.com/advisories/14291/)\nOther Advisory URL: http://www.gentoo.org/security/en/glsa/glsa-200502-18.xml\n[CVE-2005-0444](https://vulners.com/cve/CVE-2005-0444)\n", "affectedSoftware": [], "type": "osvdb", "references": [], "enchantments": {"score": {"value": 6.4, "vector": "NONE", "modified": "2017-04-28T13:20:09", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2005-0444"]}, {"type": "gentoo", "idList": ["GLSA-200502-18"]}, {"type": "nessus", "idList": ["GENTOO_GLSA-200502-18.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:54850"]}], "modified": "2017-04-28T13:20:09", "rev": 2}, "vulnersScore": 6.4}, "cvss": {"vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/", "score": 4.6}, "cvelist": ["CVE-2005-0444"], "id": "OSVDB:13823"}

{"cve": [{"lastseen": "2020-12-09T19:22:18", "description": "VMware before 4.5.2.8848-r5 searches for gdk-pixbuf shared libraries using a path that includes the rrdharan world-writable temporary directory, which allows local users to execute arbitrary code.", "edition": 5, "cvss3": {}, "published": "2005-02-14T05:00:00", "title": "CVE-2005-0444", "type": "cve", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "obtainUserPrivilege": true}, "cvelist": ["CVE-2005-0444"], "modified": "2008-09-05T20:46:00", "cpe": ["cpe:/a:vmware:workstation:4.5.2_build_8848"], "id": "CVE-2005-0444", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2005-0444", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:vmware:workstation:4.5.2_build_8848:r4:*:*:*:*:*:*"]}], "openvas": [{"lastseen": "2017-07-24T12:49:52", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0444"], "description": "The remote host is missing updates announced in\nadvisory GLSA 200502-18.", "modified": "2017-07-07T00:00:00", "published": "2008-09-24T00:00:00", "id": "OPENVAS:54850", "href": "http://plugins.openvas.org/nasl.php?oid=54850", "type": "openvas", "title": "Gentoo Security Advisory GLSA 200502-18 (VMware)", "sourceData": "# OpenVAS Vulnerability Test\n# $\n# Description: Auto generated from Gentoo's XML based advisory\n#\n# Authors:\n# Thomas Reinke <reinke@securityspace.com>\n#\n# Copyright:\n# Copyright (c) 2008 E-Soft Inc. http://www.securityspace.com\n# Text descriptions are largely excerpted from the referenced\n# advisories, and are Copyright (c) the respective author(s)\n#\n# This program is free software; you can redistribute it and/or modify\n# it under the terms of the GNU General Public License version 2,\n# as published by the Free Software Foundation\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n#\n\ninclude(\"revisions-lib.inc\");\ntag_insight = \"VMware may load shared libraries from an untrusted, world-writable\ndirectory, resulting in the execution of arbitrary code.\";\ntag_solution = \"All VMware Workstation users should upgrade to the latest version:\n\n # emerge --sync\n # emerge --ask --oneshot --verbose\n'>=app-emulation/vmware-workstation-4.5.2.8848-r5'\n\nhttp://www.securityspace.com/smysecure/catid.html?in=GLSA%20200502-18\nhttp://bugs.gentoo.org/show_bug.cgi?id=81344\";\ntag_summary = \"The remote host is missing updates announced in\nadvisory GLSA 200502-18.\";\n\n \n\nif(description)\n{\n script_id(54850);\n script_cve_id(\"CVE-2005-0444\");\n script_tag(name:\"cvss_base\", value:\"4.6\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n script_version(\"$Revision: 6596 $\");\n script_tag(name:\"last_modification\", value:\"$Date: 2017-07-07 11:21:37 +0200 (Fri, 07 Jul 2017) $\");\n script_tag(name:\"creation_date\", value:\"2008-09-24 21:14:03 +0200 (Wed, 24 Sep 2008)\");\n script_name(\"Gentoo Security Advisory GLSA 200502-18 (VMware)\");\n\n\n\n script_category(ACT_GATHER_INFO);\n\n script_copyright(\"Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com\");\n script_family(\"Gentoo Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/gentoo\", \"ssh/login/pkg\");\n script_tag(name : \"insight\" , value : tag_insight);\n script_tag(name : \"solution\" , value : tag_solution);\n script_tag(name : \"summary\" , value : tag_summary);\n script_tag(name:\"qod_type\", value:\"package\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n exit(0);\n}\n\n#\n# The script code starts here\n#\n\ninclude(\"pkg-lib-gentoo.inc\");\n\nres = \"\";\nreport = \"\";\nif ((res = ispkgvuln(pkg:\"app-emulation/vmware-workstation\", unaffected: make_list(\"ge 4.5.2.8848-r5\"), vulnerable: make_list(\"lt 4.5.2.8848-r5\"))) != NULL) {\n report += res;\n}\n\nif (report != \"\") {\n security_message(data:report);\n} else if (__pkg_match) {\n exit(99); # Not vulnerable.\n}\n", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "gentoo": [{"lastseen": "2016-09-06T19:46:24", "bulletinFamily": "unix", "cvelist": ["CVE-2005-0444"], "edition": 1, "description": "### Background\n\nVMware Workstation is a powerful virtual machine for developers and system administrators. \n\n### Description\n\nTavis Ormandy of the Gentoo Linux Security Audit Team has discovered that VMware Workstation searches for gdk-pixbuf loadable modules in an untrusted, world-writable directory. \n\n### Impact\n\nA local attacker could create a malicious shared object that would be loaded by VMware, resulting in the execution of arbitrary code with the privileges of the user running VMware. \n\n### Workaround\n\nThe system administrator may create the file /tmp/rrdharan to prevent malicious users from creating a directory at that location: \n\n` # touch /tmp/rrdharan`\n\n### Resolution\n\nAll VMware Workstation users should upgrade to the latest version: \n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=app-emulation/vmware-workstation-3.2.1.2242-r4\"", "modified": "2006-05-25T00:00:00", "published": "2005-02-14T00:00:00", "id": "GLSA-200502-18", "href": "https://security.gentoo.org/glsa/200502-18", "type": "gentoo", "title": "VMware Workstation: Untrusted library search path", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2021-01-07T10:51:55", "description": "The remote host is affected by the vulnerability described in GLSA-200502-18\n(VMware Workstation: Untrusted library search path)\n\n Tavis Ormandy of the Gentoo Linux Security Audit Team has discovered\n that VMware Workstation searches for gdk-pixbuf loadable modules in an\n untrusted, world-writable directory.\n \nImpact :\n\n A local attacker could create a malicious shared object that would be\n loaded by VMware, resulting in the execution of arbitrary code with the\n privileges of the user running VMware.\n \nWorkaround :\n\n The system administrator may create the file /tmp/rrdharan to prevent\n malicious users from creating a directory at that location:\n # touch /tmp/rrdharan", "edition": 24, "published": "2005-02-15T00:00:00", "title": "GLSA-200502-18 : VMware Workstation: Untrusted library search path", "type": "nessus", "bulletinFamily": "scanner", "cvelist": ["CVE-2005-0444"], "modified": "2005-02-15T00:00:00", "cpe": ["cpe:/o:gentoo:linux", "p-cpe:/a:gentoo:linux:vmware-workstation"], "id": "GENTOO_GLSA-200502-18.NASL", "href": "https://www.tenable.com/plugins/nessus/16459", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 200502-18.\n#\n# The advisory text is Copyright (C) 2001-2015 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(16459);\n script_version(\"1.15\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/06\");\n\n script_cve_id(\"CVE-2005-0444\");\n script_xref(name:\"GLSA\", value:\"200502-18\");\n\n script_name(english:\"GLSA-200502-18 : VMware Workstation: Untrusted library search path\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"The remote host is affected by the vulnerability described in GLSA-200502-18\n(VMware Workstation: Untrusted library search path)\n\n Tavis Ormandy of the Gentoo Linux Security Audit Team has discovered\n that VMware Workstation searches for gdk-pixbuf loadable modules in an\n untrusted, world-writable directory.\n \nImpact :\n\n A local attacker could create a malicious shared object that would be\n loaded by VMware, resulting in the execution of arbitrary code with the\n privileges of the user running VMware.\n \nWorkaround :\n\n The system administrator may create the file /tmp/rrdharan to prevent\n malicious users from creating a directory at that location:\n # touch /tmp/rrdharan\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/200502-18\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"All VMware Workstation users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=app-emulation/vmware-workstation-3.2.1.2242-r4'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:L/AC:L/Au:N/C:P/I:P/A:P\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:vmware-workstation\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2005/02/14\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2005/02/15\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2005/02/14\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2005-2021 Tenable Network Security, Inc.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"app-emulation/vmware-workstation\", unaffected:make_list(\"ge 4.5.2.8848-r5\", \"rge 3.2.1.2242-r4\"), vulnerable:make_list(\"lt 4.5.2.8848-r5\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_warning(port:0, extra:qpkg_report_get());\n else security_warning(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"VMware Workstation\");\n}\n", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}]}