PT-2018-17837 · Vmware · Vmware Fusion+1

Published 2018-03-15 · Updated 2019-10-03 · CVE-2018-6957

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions VMware Workstation versions 14.x before 14.1.1 VMware Workstation version 12.x VMware Fusion versions 10.x before 10.1.1 VMware Fusion version 8.x

Description The issue is a denial-of-service vulnerability that can be triggered by opening a large number of VNC sessions. For exploitation to be possible, VNC must be manually enabled.

Recommendations For VMware Workstation versions 14.x before 14.1.1, update to version 14.1.1 or later. For VMware Workstation version 12.x, consider disabling VNC to prevent exploitation until a patch is available. For VMware Fusion versions 10.x before 10.1.1, update to version 10.1.1 or later. For VMware Fusion version 8.x, consider disabling VNC to prevent exploitation until a patch is available.

Fix

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2018-6957

Affected Products

Vmware Fusion

Vmware Workstation

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-6957 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6957 · Vendor Advisory
• https://vmware.com/security/advisories/VMSA-2018-0008.html · Vendor Advisory
• http://securityfocus.com/bid/103431 · Note
• http://securitytracker.com/id/1040539 · Note