CVE-2009-1143 is a high-severity local privilege escalation vulnerability affecting open-vm-tools version 2009.03.18-154848. The vulnerability arises from a race condition in the mount.vmhgfs (also known as hgfsmounter) utility, which is responsible for mounting VMware shared folders within guest virtual machines. Specifically, the issue is a symlink attack exploiting a realpath race condition: a local user can manipulate symbolic links during the path resolution process to bypass intended access restrictions on mounting shared folders. This allows the attacker to mount arbitrary shares or directories that should otherwise be inaccessible, potentially leading to unauthorized access to sensitive data or modification of files. The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access), indicating a failure to securely handle symbolic links during file system operations. The CVSS 3.1 base score is 7.0, reflecting high severity, with the vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. This means the attack requires local access, low privileges, and high attack complexity, but no user interaction. The impact on confidentiality, integrity, and availability is high, as the attacker can gain unauthorized access and potentially modify or disrupt shared resources. No patches or vendor-specific mitigations are listed in the provided data, and no known exploits in the wild have been reported. The vulnerability was reserved in 2009 but published in 2022, indicating it affects legacy or older versions of open-vm-tools, which are commonly used in VMware virtualized environments to enhance guest OS integration and performance.

For European organizations, the impact of CVE-2009-1143 can be significant in environments utilizing VMware virtualization with open-vm-tools installed on guest systems, especially if legacy versions are still in use. Successful exploitation allows a local attacker within a guest VM to escalate privileges or bypass access controls on shared folders, potentially exposing sensitive corporate data or enabling further lateral movement within the virtualized infrastructure. This could compromise confidentiality by unauthorized data access, integrity by unauthorized modification of files, and availability if critical shared resources are disrupted. Organizations relying on VMware virtualization for critical workloads, including financial institutions, government agencies, and enterprises with sensitive intellectual property, are at risk if they have not updated or mitigated this vulnerability. The threat is more pronounced in multi-tenant or shared hosting environments where multiple users have local access to guest VMs, increasing the likelihood of malicious insiders or compromised accounts exploiting this flaw.

Upgrade open-vm-tools to the latest available version where this vulnerability is addressed. Since the affected version is from 2009, ensure that all guest VMs run current, supported versions of open-vm-tools. Implement strict access controls and monitoring on guest virtual machines to limit local user privileges and detect suspicious activities related to mounting shared folders. Disable or restrict the use of VMware shared folders (hgfs) in environments where they are not essential, thereby reducing the attack surface. Apply host-level security controls to isolate guest VMs and prevent lateral movement in case of compromise. Regularly audit and verify symbolic link handling and file system permissions within guest VMs to detect potential exploitation attempts. In environments where legacy systems must be maintained, consider compensating controls such as application whitelisting, enhanced logging, and network segmentation to mitigate risk. Educate system administrators and security teams about the risks associated with outdated virtualization tools and the importance of timely patching.