PT-2018-8227 · Vmware · Vmware Workstation+1

Published 2018-01-05 · Updated 2018-01-25 · CVE-2017-4948

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: VMware Workstation versions 14.x before 14.1.0 VMware Workstation version 12.x Horizon View Client versions 4.x before 4.7.0

Description: The issue is an out-of-bounds read vulnerability in TPView.dll. This vulnerability may allow a guest to leak information from the host or cause a Denial of Service on the Windows OS running the affected software. The vulnerability can be exploited when virtual printing is enabled, which is not the default setting on Workstation but is enabled by default on Horizon View Client.

Recommendations: For VMware Workstation versions 14.x before 14.1.0, update to version 14.1.0 or later. For VMware Workstation version 12.x, update to a version that includes the fix for this issue. For Horizon View Client versions 4.x before 4.7.0, update to version 4.7.0 or later. As a temporary workaround, consider disabling virtual printing until a patch is available.

Fix

DoS

Information Disclosure

Out of bounds Read

Weakness Enumeration

CWE-200

CWE-125

Related Identifiers

CVE-2017-4948

Affected Products

Horizon View Client

Vmware Workstation

References · 7

• https://vmware.com/us/security/advisories/VMSA-2018-0003.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-4948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-4948 · Security Note
• http://securityfocus.com/bid/102441 · Note
• http://securitytracker.com/id/1040109 · Note
• http://securitytracker.com/id/1040108 · Note
• http://securitytracker.com/id/1040136 · Note