CVE-2014-8370: Medium severity vmware player vulnerability

Published Jan 29, 2015

Updated

VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi 5.0 through 5.5 allow host OS users to gain host OS privileges or cause a denial of service (arbitrary write to a file) by modifying a configuration file.

Affected Software

21 affected components

VMware Player=6.0

VMware Player=6.0.1

VMware Player=6.0.2

VMware Player=6.0.3

VMware Player=6.0.4

VMware Fusion=6.0

VMware Fusion=6.0.1

VMware Fusion=6.0.2

VMware Fusion=6.0.3

VMware Fusion=6.0.4

VMware Workstation=10.0

VMware Workstation=10.0.1

VMware Workstation=10.0.2

VMware Workstation=10.0.3

VMware Workstation=10.0.4

VMware ESXi=5.0

VMware ESXi=5.0-1

VMware ESXi=5.0-2

VMware ESXi=5.1

VMware ESXi=5.1-1

VMware ESXi=5.5

Remediation

Patch Available

http://www.vmware.com/security/advisories/VMSA-2015-0001.html

Event History

Jan 29, 2015

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-8370?

CVE-2014-8370 is considered a high severity vulnerability allowing host OS users to gain privileges or cause a denial of service.

How do I fix CVE-2014-8370?

To fix CVE-2014-8370, upgrade to the patched versions of VMware Workstation, Fusion, Player, or ESXi as specified in VMware's advisory.

What software is affected by CVE-2014-8370?

CVE-2014-8370 affects VMware Workstation 10.x before 10.0.5, VMware Player 6.x before 6.0.5, VMware Fusion 6.x before 6.0.5, and VMware ESXi versions 5.0 through 5.5.

Can CVE-2014-8370 lead to data breach?

Yes, CVE-2014-8370 can potentially lead to data breaches due to unauthorized host OS privilege escalation.

Is there a workaround for CVE-2014-8370?

There are no specific workarounds for CVE-2014-8370; upgrading to the latest version is the recommended remediation.