ID CVE-2017-4949
Summary VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default.
References
Vulnerable Configurations
  • VMware Fusion 8.0.0
    cpe:2.3:a:vmware:fusion:8.0.0
  • VMware Fusion 8.0.1
    cpe:2.3:a:vmware:fusion:8.0.1
  • VMware Fusion 8.0.2
    cpe:2.3:a:vmware:fusion:8.0.2
  • VMware Fusion 8.1.0
    cpe:2.3:a:vmware:fusion:8.1.0
  • VMware Fusion 8.5.0
    cpe:2.3:a:vmware:fusion:8.5.0
  • VMware Fusion 8.5.1
    cpe:2.3:a:vmware:fusion:8.5.1
  • Apple Mac OS X
    cpe:2.3:o:apple:mac_os_x
  • VMWare Workstation 12.0.0
    cpe:2.3:a:vmware:workstation:12.0.0
  • VMWare Workstation 12.5.0
    cpe:2.3:a:vmware:workstation:12.5.0
  • VMWare Workstation 12.5.4
    cpe:2.3:a:vmware:workstation:12.5.4
  • VMWare Workstation 12.5.5
    cpe:2.3:a:vmware:workstation:12.5.5
  • VMWare Workstation 12.5.6
    cpe:2.3:a:vmware:workstation:12.5.6
  • VMWare Workstation 12.5.7
    cpe:2.3:a:vmware:workstation:12.5.7
CVSS
Base: 6.9
Impact:
Exploitability:
CWE CWE-416
CAPEC
nessus via4
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FUSION_VMSA_2018_0004.NASL
    description The version of VMware Fusion installed on the remote macOS or Mac OS X host is 8.x prior to 8.5.10 or 10.x prior to 10.1.1. It is, therefore, missing security updates that add hypervisor-assisted guest remediation for a speculative execution vulnerability (CVE-2017-5715). These updates will allow guest operating systems to use hardware support for branch target mitigation and will require guest OS security updates as detailed in VMware Knowledge Base article 52085. It is also affected by use-after-free and integer-overflow vulnerabilities. Note that hypervisor-specific remediation's for this vulnerability were released as part of VMSA-2018-0002.
    last seen 2019-02-21
    modified 2018-07-14
    plugin id 105781
    published 2018-01-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=105781
    title VMware Fusion 8.x < 8.5.10 / 10.x < 10.1.1 Multiple Vulnerabilities (VMSA-2018-0004) (VMSA-2018-0005) (Spectre) (macOS)
  • NASL family Windows
    NASL id VMWARE_PLAYER_WIN_VMSA_2018_0004.NASL
    description The version of VMware Player installed on the remote Windows host is 14.x prior to 14.1.1 or 12.x prior to 12.5.9. It is, therefore, missing security updates that add hypervisor-assisted guest remediation for a speculative execution vulnerability (CVE-2017-5715). These updates will allow guest operating systems to use hardware support for branch target mitigation and require guest OS security updates as detailed in VMware Knowledge Base article 52085. It is also affected by use-after-free and integer-overflow vulnerabilities. Note that hypervisor-specific remediation's for this vulnerability were released as part of VMSA-2018-0002.
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 105783
    published 2018-01-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=105783
    title VMware Player 12.x < 12.5.9 / 14.x < 14.1.1 Multiple Vulnerabilities (VMSA-2018-0004) (VMSA-2018-0005) (Spectre)
  • NASL family Windows
    NASL id VMWARE_WORKSTATION_WIN_VMSA_2018_0004.NASL
    description The version of VMware Workstation installed on the remote Windows host is 14.x prior to 14.1.1 or 12.x prior to 12.5.9. It is, therefore, missing security updates that add hypervisor-assisted guest remediation for a speculative execution vulnerability (CVE-2017-5715). These updates will allow guest operating systems to use hardware support for branch target mitigation and will require guest OS security updates as detailed in VMware Knowledge Base article 52085. It is also affected by use-after-free and integer-overflow vulnerabilities. Note that hypervisor-specific remediation's for this vulnerability were released as part of VMSA-2018-0002.
    last seen 2019-02-21
    modified 2018-08-06
    plugin id 105785
    published 2018-01-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=105785
    title VMware Workstation 12.x < 12.5.9 / 14.x < 14.1.1 Multiple Vulnerabilities (VMSA-2018-0004) (VMSA-2018-0005) (Spectre)
refmap via4
bid 102489
confirm https://www.vmware.com/security/advisories/VMSA-2018-0005.html
sectrack 1040161
vmware via4
description VMware Workstation and Fusion contain a use-after-free vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may allow a guest to execute code on the host. Note: IPv6 mode for VMNAT is not enabled by default.
finder
company Tencent's Xuanwu LAB
name WenQunWang
id VMSA-2018-0005
last_updated 2018-01-10T00:00:00
published 2018-01-10T00:00:00
title VMware Workstation, and Fusion updates resolve use-after-free and integer-overflow vulnerabilities
workaround None
Last major update 11-01-2018 - 09:29
Published 11-01-2018 - 09:29
Last modified 12-02-2018 - 19:34
Back to Top