PT-2017-2235 · Vmware · Workstation Pro+5

Published 2017-03-30 · Updated 2022-02-03 · CVE-2017-4902

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 6.5 without patch ESXi650-201703410-SG VMware ESXi version 5.5 without patch ESXi550-201703401-SG Workstation Pro / Player versions 12.x prior to 12.5.5 Fusion Pro / Fusion versions 8.x prior to 8.5.6

Description The issue is related to a Heap Buffer Overflow in SVGA, which may allow a guest to execute code on the host. This could potentially enable an attacker to execute arbitrary code in the host system. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For VMware ESXi version 5.5, apply patch ESXi550-201703401-SG. For VMware ESXi version 6.5, apply patch ESXi650-201703410-SG. For Workstation Pro / Player versions 12.x, update to version 12.5.5 or later. For Fusion Pro / Fusion versions 8.x, update to version 8.5.6 or later.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2017-01429

CVE-2017-4902

ZDI-17-235

ZDI-17-236

Affected Products

Fusion

Fusion Pro

Vmware Esxi

Vmware Workstation

Workstation Player

Workstation Pro

References · 9

• https://zerodayinitiative.com/advisories/ZDI-17-235 · Security Note
• https://bdu.fstec.ru/vul/2017-01429 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-17-236 · Security Note
• http://vmware.com/security/advisories/VMSA-2017-0006.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-4902 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4902 · Security Note
• http://securitytracker.com/id/1038148 · Note
• http://securityfocus.com/bid/97163 · Note
• http://securitytracker.com/id/1038149 · Note