CVE-2017-16777: High severity HashiCorp Vagrant VMware Fusion vulnerability
If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake application directory and exploit the suid sudo helper in order to escalate to root.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-16777?
CVE-2017-16777 is classified as a local privilege escalation vulnerability.
How do I fix CVE-2017-16777?
To address CVE-2017-16777, ensure that VMware Fusion is properly installed or uninstall the vagrant-vmware-fusion plugin if it is not needed.
Who is affected by CVE-2017-16777?
Users of HashiCorp Vagrant VMware Fusion plugin version 5.0.3 without VMware Fusion installed are affected by CVE-2017-16777.
What can an attacker do with CVE-2017-16777?
An attacker can exploit CVE-2017-16777 to escalate privileges to root by creating a fake application directory.
Is CVE-2017-16777 being actively exploited?
There have been reports of CVE-2017-16777 being actively exploited in the wild.