PT-2018-17852 · Vmware · Vmware Esxi+2

Publicado 2018-07-25 · Atualizado 2022-06-02 · CVE-2018-6972

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 6.7 before ESXi670-201806401-BG VMware ESXi versions 6.5 before ESXi650-201806401-BG VMware ESXi versions 6.0 before ESXi600-201806401-BG VMware ESXi versions 5.5 before ESXi550-201806401-BG VMware Workstation versions 14.x before 14.1.2 VMware Fusion versions 10.x before 10.1.2

Description The issue is due to a NULL pointer dereference in the RPC handler, which can cause a denial-of-service. This can allow attackers with normal user privileges to crash their VMs.

Recommendations For VMware ESXi versions 6.7 before ESXi670-201806401-BG, update to ESXi670-201806401-BG or later. For VMware ESXi versions 6.5 before ESXi650-201806401-BG, update to ESXi650-201806401-BG or later. For VMware ESXi versions 6.0 before ESXi600-201806401-BG, update to ESXi600-201806401-BG or later. For VMware ESXi versions 5.5 before ESXi550-201806401-BG, update to ESXi550-201806401-BG or later. For VMware Workstation versions 14.x before 14.1.2, update to 14.1.2 or later. For VMware Fusion versions 10.x before 10.1.2, update to 10.1.2 or later.

Correção

DoS

NULL Pointer Dereference

Enumeração de Fraquezas

CWE-476

Identificadores relacionados

CVE-2018-6972

ZDI-18-779

Produtos afetados

Vmware Esxi

Vmware Fusion

Vmware Workstation

Referências · 7

• https://zerodayinitiative.com/advisories/ZDI-18-779 · Nota de Segurança
• http://securityfocus.com/bid/104884 · Nota
• http://securitytracker.com/id/1041357 · Nota
• https://vmware.com/security/advisories/VMSA-2018-0018.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6972 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-6972 · Aviso do Fabricante
• http://securitytracker.com/id/1041356 · Nota