PT-2017-16188 · Vmware · Vmware Horizon Daas

Publicado 2017-05-31 · Atualizado 2017-07-17 · CVE-2017-4897

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware Horizon DaaS versions prior to 7.0.0

Description The issue is caused by insufficient validation of data, allowing an attacker to exploit it by tricking users into connecting to a malicious server. This can be achieved by sharing a specially crafted RDP file through the DaaS client, which the victim downloads by clicking on a malicious link. Successful exploitation requires user interaction.

Recommendations For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to untrusted RDP files and avoiding clicking on malicious links to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2017-4897

Produtos afetados

Vmware Horizon Daas

Referências · 5

• http://securitytracker.com/id/1037951 · Nota
• http://securityfocus.com/bid/96559 · Nota
• http://vmware.com/security/advisories/VMSA-2017-0002.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-4897 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-4897 · Aviso do Fabricante