CVE-2017-7642
HighSummary
The HashiCorp Vagrant VMware Fusion plugin before version 4.0.21 contains a vulnerability that allows local users to gain root privileges. The issue arises from the failure to verify the path to the encoded Ruby script and the lack of scrubbing of the PATH variable.
Risk Assessment
Organizations may be exposed to unauthorized access to systems, potentially leading to serious security breaches. Local users gaining root privileges poses a risk to the integrity and confidentiality of data.
Recommendation
It is recommended to update the plugin to version 4.0.21 or later to mitigate this vulnerability. Additionally, conducting an audit of user permissions in the system is advisable.
Other vulnerabilities in HashiCorp Vagrant VMware Fusion plugin
See all- CVE-2017-12579High
The HashiCorp Vagrant VMware Fusion plugin version 4.0.24 and earlier contains an insecure suid wrapper binary that allows a non-root user to obtain a root shell.
- CVE-2017-11741High
The HashiCorp Vagrant VMware Fusion plugin before version 4.0.24 uses weak permissions for the sudo helper scripts, allowing local users to execute arbitrary code with root privileges by overwriting one of the scripts.
Original NVD description (English source)
The sudo helper in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) before 4.0.21 allows local users to gain root privileges by leveraging failure to verify the path to the encoded ruby script or scrub the PATH variable.