CVE-2017-11741
HighSummary
The HashiCorp Vagrant VMware Fusion plugin before version 4.0.24 uses weak permissions for the sudo helper scripts, allowing local users to execute arbitrary code with root privileges by overwriting one of the scripts.
Risk Assessment
This vulnerability poses a risk to organizations as local users can gain unauthorized access to the system with administrator privileges.
Recommendation
It is recommended to update the plugin to version 4.0.24 or later and review the permissions of the sudo helper scripts.
Other vulnerabilities in HashiCorp Vagrant VMware Fusion plugin
See all- CVE-2017-12579High
The HashiCorp Vagrant VMware Fusion plugin version 4.0.24 and earlier contains an insecure suid wrapper binary that allows a non-root user to obtain a root shell.
- CVE-2017-7642High
The HashiCorp Vagrant VMware Fusion plugin before version 4.0.21 contains a vulnerability that allows local users to gain root privileges. The issue arises from the failure to verify the path to the encoded Ruby script and the lack of scrubbing of the PATH variable.
Original NVD description (English source)
HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.24 uses weak permissions for the sudo helper scripts, allows local users to execute arbitrary code with root privileges by overwriting one of the scripts.