PT-2018-8225 · Microsoft+1 · Windows+3

Published 2018-01-05 · Updated 2019-10-03 · CVE-2017-4945

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: VMware Workstation versions 12.x through 14.x VMware Fusion versions 8.x through 10.x

Description: The issue allows program execution via Unity on locked Windows VMs. This may potentially lead to unauthorized access. The estimated number of affected devices is not specified.

Recommendations: For VMware Workstation versions 12.x through 14.x, update VMware Tools to 10.2.0. For VMware Fusion versions 8.x through 10.x, update VMware Tools to 10.2.0. As a permanent fix, consider updating to Workstation 14.1.0 or Fusion 10.1.0, which consume VMware Tools 10.2.0 by default.

Fix

Related Identifiers

CVE-2017-4945

Affected Products

Vmware Fusion

Vmware Tools

Vmware Workstation

Windows

References · 6

• https://vmware.com/us/security/advisories/VMSA-2018-0003.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-4945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4945 · Security Note
• http://securityfocus.com/bid/102441 · Note
• http://securitytracker.com/id/1040109 · Note
• http://securitytracker.com/id/1040136 · Note