PT-2018-8227 · Vmware · Vmware Workstation+1

Publicado 2018-01-05 · Atualizado 2018-01-25 · CVE-2017-4948

Positive Technologies (AI Summary)

CVSS v3.1

7.1

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: VMware Workstation versions 14.x before 14.1.0 VMware Workstation version 12.x Horizon View Client versions 4.x before 4.7.0

Description: The issue is an out-of-bounds read vulnerability in TPView.dll. This vulnerability may allow a guest to leak information from the host or cause a Denial of Service on the Windows OS running the affected software. The vulnerability can be exploited when virtual printing is enabled, which is not the default setting on Workstation but is enabled by default on Horizon View Client.

Recommendations: For VMware Workstation versions 14.x before 14.1.0, update to version 14.1.0 or later. For VMware Workstation version 12.x, update to a version that includes the fix for this issue. For Horizon View Client versions 4.x before 4.7.0, update to version 4.7.0 or later. As a temporary workaround, consider disabling virtual printing until a patch is available.

Correção

DoS

Information Disclosure

Out of bounds Read

Enumeração de Fraquezas

CWE-200

CWE-125

Identificadores relacionados

CVE-2017-4948

Produtos afetados

Horizon View Client

Vmware Workstation

Referências · 7

• http://securityfocus.com/bid/102441 · Nota
• http://securitytracker.com/id/1040109 · Nota
• http://securitytracker.com/id/1040108 · Nota
• https://vmware.com/us/security/advisories/VMSA-2018-0003.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-4948 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-4948 · Nota de Segurança
• http://securitytracker.com/id/1040136 · Nota