CVE-2017-12579
HighSummary
The HashiCorp Vagrant VMware Fusion plugin version 4.0.24 and earlier contains an insecure suid wrapper binary that allows a non-root user to obtain a root shell.
Risk Assessment
The organization may be exposed to unauthorized access to the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update the plugin to the latest version to mitigate this vulnerability.
Other vulnerabilities in HashiCorp Vagrant VMware Fusion plugin
See all- CVE-2017-11741High
The HashiCorp Vagrant VMware Fusion plugin before version 4.0.24 uses weak permissions for the sudo helper scripts, allowing local users to execute arbitrary code with root privileges by overwriting one of the scripts.
- CVE-2017-7642High
The HashiCorp Vagrant VMware Fusion plugin before version 4.0.21 contains a vulnerability that allows local users to gain root privileges. The issue arises from the failure to verify the path to the encoded Ruby script and the lack of scrubbing of the PATH variable.
Original NVD description (English source)
An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a root shell.