CVE-2013-1662
VMware Workstation 8.x-9.x and Player 4.x-5.x - Privilege Escalation via PATH lsb_release Hijacking
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2013-1662.
PoCs published by Metasploit, Tavis Ormandy, Tavis Ormandy, egypt, including Metasploit module exploits/linux/local/vmware_mount.
AI-analyzed exploit summary This Metasploit module exploits a privilege escalation vulnerability in VMWare Workstation/Player (up to 9.0.2) by leveraging a setuid binary (vmware-mount) that executes lsb_release via popen(3) without sanitizing the PATH. The exploit writes a malicious lsb_release executable to the current directory and manipulates PATH to achieve root execution.
Description
vmware-mount in VMware Workstation 8.x and 9.x and VMware Player 4.x and 5.x, on systems based on Debian GNU/Linux, allows host OS users to gain host OS privileges via a crafted lsb_release binary in a directory in the PATH, related to use of the popen library function.
Exploits (3)
This Metasploit module exploits a privilege escalation vulnerability in VMWare Workstation/Player (up to 9.0.2) by leveraging a setuid binary (vmware-mount) that executes lsb_release via popen(3) without sanitizing the PATH. The exploit writes a malicious lsb_release executable to the current directory and manipulates PATH to achieve root execution.
The writeup discusses a privilege escalation vulnerability (CVE-2013-1662) in Debian/Ubuntu systems due to the lack of privilege-dropping behavior in dash (used as /bin/sh) compared to bash. It highlights how this can be exploited in setuid programs like VMware utilities to gain root access.
This Metasploit module exploits a privilege escalation vulnerability in VMWare Workstation/Player by leveraging a setuid binary (vmware-mount) that executes lsb_release from the user-controlled PATH, allowing arbitrary code execution as root.