« Back to list

CVE-2007-1056

Status: ModifiedHigh (7.2)—

VMware Workstation 5.5.3 build 34685 does not provide per-user restrictions on certain privileged actions, which allows local users to perform restricted operations such as changing system time, accessing hardware components, and stopping the "VMware tools service" service.

Read full descriptionShow less

NOTE: exploitation is simplified via (1) weak file permissions (Users = Read & Execute) for %PROGRAMFILES%\VMware; and weak registry key permissions (access by Users) for (2) vmmouse, (3) vmscsi, (4) VMTools, (5) vmx_svga, and (6) vmxnet in HKLM\SYSTEM\CurrentControlSet\Services\; which allows local users to perform various privileged actions outside of the guest OS by executing certain files under %PROGRAMFILES%\VMware\VMware Tools, as demonstrated by (a) VMControlPanel.cpl and (b) vmwareservice.exe.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Vmware — Workstation

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2007-1056",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.2,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": true,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-02-21T23:28:00.000",
  "references": [
    {
      "url": "http://osvdb.org/45244",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://securityreason.com/securityalert/2281",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/460664/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/461807/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/45244",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://securityreason.com/securityalert/2281",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/460664/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/461807/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "VMware Workstation 5.5.3 build 34685 does not provide per-user restrictions on certain privileged actions, which allows local users to perform restricted operations such as changing system time, accessing hardware components, and stopping the \"VMware tools service\" service. NOTE: exploitation is simplified via (1) weak file permissions (Users = Read & Execute) for %PROGRAMFILES%\\VMware; and weak registry key permissions (access by Users) for (2) vmmouse, (3) vmscsi, (4) VMTools, (5) vmx_svga, and (6) vmxnet in HKLM\\SYSTEM\\CurrentControlSet\\Services\\; which allows local users to perform various privileged actions outside of the guest OS by executing certain files under %PROGRAMFILES%\\VMware\\VMware Tools, as demonstrated by (a) VMControlPanel.cpl and (b) vmwareservice.exe."
    },
    {
      "lang": "es",
      "value": "VMware Workstation versión 5.5.3 build 34685, no proporciona restricciones por usuario en ciertas acciones privilegiadas, lo que permite a los usuarios locales realizar operaciones restringidas, tales como cambiar la hora del sistema, acceder a los componentes de hardware y detener el servicio \"VMware tools service\". NOTA: la explotación es simplificada por medio de (1) permisos de archivos débiles (Users = Read & Execute) para %PROGRAMFILES%\\VMware; y permisos de clave de registro débiles (access by Users) para (2) vmmouse, (3) vmscsi, (4) VMTools, (5) vmx_svga y (6) vmxnet en HKLM\\SYSTEM\\CurrentControlSet\\Services\\; lo que permite a los usuarios locales realizar varias acciones privilegiadas fuera del sistema operativo invitado por medio de la ejecución de ciertos archivos bajo herramientas %PROGRAMFILES%\\VMware\\VMware, como es demostrado por (a) VMControlPanel.cpl y (b) vmwareservice.exe."
    }
  ],
  "lastModified": "2026-06-16T22:36:50.467",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:vmware:workstation:5.5.3_build_34685:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "51C6D608-64DE-4CC4-9869-3342E8FD707F"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}