PT-2017-2636 · Vmware+1 · Vmware Horizon View Client+1

Publicado 2017-06-08 · Atualizado 2017-07-08 · CVE-2017-4918

Positive Technologies (AI Summary)

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Horizon View Client versions 2.x through 4.x prior to 4.5.0

Description The issue is related to a lack of input sanitization in the script that starts services for the VMware Horizon View Client virtualization system. This could allow an unprivileged, remote attacker to escalate their privileges to a superuser. The vulnerability may be exploited to gain root access on Mac OSX systems where the client is installed.

Recommendations For versions 2.x through 4.x prior to 4.5.0, update to version 4.5.0 or later to resolve the issue.

Exploit

Correção

Command Injection

Enumeração de Fraquezas

CWE-77

Identificadores relacionados

BDU:2017-01863

CVE-2017-4918

Produtos afetados

Macos X

Vmware Horizon View Client

Referências · 7

• 🔥 https://bogner.sh/2017/07/cve-2017-4918-code-injection-in-vmware-horizons-macos-client · Exploit
• https://bdu.fstec.ru/vul/2017-01863 · Nota de Segurança
• http://securityfocus.com/bid/98984 · Nota
• https://osv.dev/vulnerability/CVE-2017-4918 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-4918 · Nota de Segurança
• https://vmware.com/security/advisories/VMSA-2017-0011.html · Aviso do Fabricante
• http://securitytracker.com/id/1038642 · Nota