Integer Overflow Vulnerability in VMware Workstation and Fusion NAT Service
CVE-2017-4950

7HIGH

Key Information:

Vendor

Vmware
Status
Workstation Pro / Player
Fusion
Vendor
CVE Published:
11 January 2018

What is CVE-2017-4950?

VMware Workstation and Fusion have a vulnerability in the NAT service related to integer overflow when IPv6 mode is enabled. This flaw may allow an out-of-bound read to occur, potentially enabling unauthorized code execution on the host system when exploited in conjunction with other vulnerabilities. Notably, IPv6 mode is not enabled by default for VMNAT, reducing the vulnerability's exposure.

Affected Version(s)

Fusion 10.x before 10.1.1

Fusion 8.x before 8.5.10

Workstation Pro / Player 14.x before 14.1.1

References

http://www.securitytracker.com/id/1040161
vdb-entryx_refsource_SECTRACK
https://www.vmware.com/security/advisories/VMSA-2018-0005...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/102490
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.