PT-2018-17852 · Vmware · Vmware Esxi+2

Published 2018-07-25 · Updated 2022-06-02 · CVE-2018-6972

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions VMware ESXi versions 6.7 before ESXi670-201806401-BG VMware ESXi versions 6.5 before ESXi650-201806401-BG VMware ESXi versions 6.0 before ESXi600-201806401-BG VMware ESXi versions 5.5 before ESXi550-201806401-BG VMware Workstation versions 14.x before 14.1.2 VMware Fusion versions 10.x before 10.1.2

Description The issue is due to a NULL pointer dereference in the RPC handler, which can cause a denial-of-service. This can allow attackers with normal user privileges to crash their VMs.

Recommendations For VMware ESXi versions 6.7 before ESXi670-201806401-BG, update to ESXi670-201806401-BG or later. For VMware ESXi versions 6.5 before ESXi650-201806401-BG, update to ESXi650-201806401-BG or later. For VMware ESXi versions 6.0 before ESXi600-201806401-BG, update to ESXi600-201806401-BG or later. For VMware ESXi versions 5.5 before ESXi550-201806401-BG, update to ESXi550-201806401-BG or later. For VMware Workstation versions 14.x before 14.1.2, update to 14.1.2 or later. For VMware Fusion versions 10.x before 10.1.2, update to 10.1.2 or later.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2018-6972

ZDI-18-779

Affected Products

Vmware Esxi

Vmware Fusion

Vmware Workstation

References · 7

• https://zerodayinitiative.com/advisories/ZDI-18-779 · Security Note
• https://vmware.com/security/advisories/VMSA-2018-0018.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6972 · Security Note
• https://osv.dev/vulnerability/CVE-2018-6972 · Vendor Advisory
• http://securityfocus.com/bid/104884 · Note
• http://securitytracker.com/id/1041357 · Note
• http://securitytracker.com/id/1041356 · Note