CVE-2017-16777
HighSummary
The HashiCorp Vagrant VMware Fusion plugin version 5.0.3, when installed without VMware Fusion, allows a local attacker to create a fake application directory and exploit the suid sudo helper to escalate privileges to root.
Risk Assessment
An attacker could gain full control of the system, posing a significant security threat to the organization.
Recommendation
It is recommended to remove the vagrant-vmware-fusion plugin if VMware Fusion is not installed to mitigate the risk of privilege escalation.
Other vulnerabilities in HashiCorp Vagrant VMware Fusion plugin version 5.0.3
See all- CVE-2017-16001High
The HashiCorp Vagrant VMware Fusion plugin version 5.0.1 is vulnerable to a local attack that allows silent subversion of the plugin update process, potentially leading to root privilege escalation.
- CVE-2017-15884High
The HashiCorp Vagrant VMware Fusion plugin version 5.0.0 is vulnerable to a local attack that allows silent subversion of the plugin update process, potentially leading to root privilege escalation.
Original NVD description (English source)
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root.