Beyond this, various fixes were also made to the plugin itself for safer operation. The new unified Vagrant VMware plugin includes a new step (the VMware Utility) to separate the privileged operations required for the plugin to operate and relies on system installers to safely install these services. We apologize for how long this has taken and thank Mark for working patiently with us as we worked toward this release. It has taken until now to restructure the plugin to resolve these vulnerabilities. These vulnerabilities were reported to HashiCorp in late 2017 as part of a batch of critical findings by Mark Wadham. We will edit this post and link directly to the CVEs here as they are published.

The vulnerabilities fixed include mechanisms for root privilege escalation from a malicious Vagrantfile or previously installed malware outside of the Vagrantfile. The update will work with all supported versions of VMware Fusion and Workstation. This update fixes a number of critical security vulnerabilities in prior versions and is highly recommended. Vagrant VMware Desktop (Vagrant plugin).Vagrant VMware Utility (System installation package).A number of issues resulted from this installation approach and to resolve the issue the Vagrant VMware Desktop plugin now consists of two parts:

Included within this installation process was the setup for privileged access required for VMware interaction. In previous versions of the VMware Fusion and Workstation plugins, all setup was performed during the plugin installation process. The unification of these two plugins includes an implementation update which has resulted in a separation of duties within the plugin. The Vagrant VMware Desktop plugin now supports both VMware Workstation and VMware Fusion. All users are recommended to install this update immediately. This process addresses critical security issues that were found in prior versions. The new VMware Desktop plugin includes an updated implementation and installation process. Existing users of the Vagrant VMware Fusion or Workstation plugins can update to the new VMware Desktop plugin free of charge. This plugin is a unification of the Vagrant VMware Fusion plugin for macOS and the Vagrant VMware Workstation plugin for Linux and Windows. We are pleased to announce the release of the Vagrant VMware Desktop plugin.

Vmware workstation license