ID CVE-2017-4950
Summary VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound read which can then be used to execute code on the host in conjunction with other issues. Note: IPv6 mode for VMNAT is not enabled by default.
References
Vulnerable Configurations
  • VMware Fusion 8.0.0
    cpe:2.3:a:vmware:fusion:8.0.0
  • VMware Fusion 8.0.1
    cpe:2.3:a:vmware:fusion:8.0.1
  • VMware Fusion 8.0.2
    cpe:2.3:a:vmware:fusion:8.0.2
  • VMware Fusion 8.1.0
    cpe:2.3:a:vmware:fusion:8.1.0
  • VMware Fusion 8.5.0
    cpe:2.3:a:vmware:fusion:8.5.0
  • VMware Fusion 8.5.1
    cpe:2.3:a:vmware:fusion:8.5.1
  • Apple Mac OS X
    cpe:2.3:o:apple:mac_os_x
  • VMWare Workstation 12.0.0
    cpe:2.3:a:vmware:workstation:12.0.0
  • VMWare Workstation 12.5.0
    cpe:2.3:a:vmware:workstation:12.5.0
  • VMWare Workstation 12.5.4
    cpe:2.3:a:vmware:workstation:12.5.4
  • VMWare Workstation 12.5.5
    cpe:2.3:a:vmware:workstation:12.5.5
  • VMWare Workstation 12.5.6
    cpe:2.3:a:vmware:workstation:12.5.6
  • VMWare Workstation 12.5.7
    cpe:2.3:a:vmware:workstation:12.5.7
CVSS
Base: 6.9
Impact:
Exploitability:
CWE CWE-190
CAPEC
  • Forced Integer Overflow
    This attack forces an integer variable to go out of range. The integer variable is often used as an offset such as size of memory allocation or similarly. The attacker would typically control the value of such variable and try to get it out of range. For instance the integer in question is incremented past the maximum possible value, it may wrap to become a very small, or negative number, therefore providing a very incorrect value which can lead to unexpected behavior. At worst the attacker can execute arbitrary code.
nessus via4
  • NASL family Windows
    NASL id VMWARE_PLAYER_WIN_VMSA_2018_0004.NASL
    description The version of VMware Player installed on the remote Windows host is 14.x prior to 14.1.1 or 12.x prior to 12.5.9. It is, therefore, missing security updates that add hypervisor-assisted guest remediation for a speculative execution vulnerability (CVE-2017-5715). These updates will allow guest operating systems to use hardware support for branch target mitigation and require guest OS security updates as detailed in VMware Knowledge Base article 52085. It is also affected by use-after-free and integer-overflow vulnerabilities. Note that hypervisor-specific remediation's for this vulnerability were released as part of VMSA-2018-0002.
    last seen 2019-01-16
    modified 2018-08-06
    plugin id 105783
    published 2018-01-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=105783
    title VMware Player 12.x < 12.5.9 / 14.x < 14.1.1 Multiple Vulnerabilities (VMSA-2018-0004) (VMSA-2018-0005) (Spectre)
  • NASL family Windows
    NASL id VMWARE_WORKSTATION_WIN_VMSA_2018_0004.NASL
    description The version of VMware Workstation installed on the remote Windows host is 14.x prior to 14.1.1 or 12.x prior to 12.5.9. It is, therefore, missing security updates that add hypervisor-assisted guest remediation for a speculative execution vulnerability (CVE-2017-5715). These updates will allow guest operating systems to use hardware support for branch target mitigation and will require guest OS security updates as detailed in VMware Knowledge Base article 52085. It is also affected by use-after-free and integer-overflow vulnerabilities. Note that hypervisor-specific remediation's for this vulnerability were released as part of VMSA-2018-0002.
    last seen 2019-01-16
    modified 2018-08-06
    plugin id 105785
    published 2018-01-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=105785
    title VMware Workstation 12.x < 12.5.9 / 14.x < 14.1.1 Multiple Vulnerabilities (VMSA-2018-0004) (VMSA-2018-0005) (Spectre)
  • NASL family MacOS X Local Security Checks
    NASL id MACOSX_FUSION_VMSA_2018_0004.NASL
    description The version of VMware Fusion installed on the remote macOS or Mac OS X host is 8.x prior to 8.5.10 or 10.x prior to 10.1.1. It is, therefore, missing security updates that add hypervisor-assisted guest remediation for a speculative execution vulnerability (CVE-2017-5715). These updates will allow guest operating systems to use hardware support for branch target mitigation and will require guest OS security updates as detailed in VMware Knowledge Base article 52085. It is also affected by use-after-free and integer-overflow vulnerabilities. Note that hypervisor-specific remediation's for this vulnerability were released as part of VMSA-2018-0002.
    last seen 2019-01-16
    modified 2018-07-14
    plugin id 105781
    published 2018-01-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=105781
    title VMware Fusion 8.x < 8.5.10 / 10.x < 10.1.1 Multiple Vulnerabilities (VMSA-2018-0004) (VMSA-2018-0005) (Spectre) (macOS)
refmap via4
bid 102490
confirm https://www.vmware.com/security/advisories/VMSA-2018-0005.html
sectrack 1040161
vmware via4
description VMware Workstation and Fusion contain an integer overflow vulnerability in VMware NAT service when IPv6 mode is enabled. This issue may lead to an out-of-bound read which can then be used to execute code on the host in conjunction with other issues. Note: IPv6 mode for VMNAT is not enabled by default.
finder
company Tencent's Xuanwu LAB
name WenQunWang
id VMSA-2018-0005
last_updated 2018-01-10T00:00:00
published 2018-01-10T00:00:00
title VMware Workstation, and Fusion updates resolve use-after-free and integer-overflow vulnerabilities
workaround None
Last major update 11-01-2018 - 09:29
Published 11-01-2018 - 09:29
Last modified 12-02-2018 - 19:35
Back to Top