PT-2017-16188 · Vmware · Vmware Horizon Daas

Published 2017-05-31 · Updated 2017-07-17 · CVE-2017-4897

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions VMware Horizon DaaS versions prior to 7.0.0

Description The issue is caused by insufficient validation of data, allowing an attacker to exploit it by tricking users into connecting to a malicious server. This can be achieved by sharing a specially crafted RDP file through the DaaS client, which the victim downloads by clicking on a malicious link. Successful exploitation requires user interaction.

Recommendations For versions prior to 7.0.0, update to version 7.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to untrusted RDP files and avoiding clicking on malicious links to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2017-4897

Affected Products

Vmware Horizon Daas

References · 5

• http://vmware.com/security/advisories/VMSA-2017-0002.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4897 · Security Note
• https://osv.dev/vulnerability/CVE-2017-4897 · Vendor Advisory
• http://securitytracker.com/id/1037951 · Note
• http://securityfocus.com/bid/96559 · Note