[原文]Format string vulnerability in VMware Workstation 4.5.2 build-8848, if running with elevated privileges, might allow local users to execute arbitrary code via format string specifiers in command line arguments. NOTE: it is not clear if there are any default or typical circumstances under which VMware would be running with privileges beyond those already available to the attackers, so this might not be a vulnerability.
VMware Workstation Format String Arbitrary Local Code Execution
Local Access Required,
Local / Remote,
Loss of Confidentiality,
Loss of Integrity
VMware Workstation contains a flaw that may allow a malicious user to do privilege escalation. The issue is triggered when VMware is installed with suid and format specifier characters are passed using the command line. It is possible that the flaw may facilitate privilege escalation resulting in a loss of confidentiality.
Currently, there are no known upgrades, patches, or workarounds available to correct this issue.