Integer Overflow Vulnerability in VMware Workstation and Fusion NAT Service
CVE-2017-4950
7HIGH
Key Information:
- Vendor
- Vmware
- Vendor
- CVE Published:
- 11 January 2018
Summary
VMware Workstation and Fusion have a vulnerability in the NAT service related to integer overflow when IPv6 mode is enabled. This flaw may allow an out-of-bound read to occur, potentially enabling unauthorized code execution on the host system when exploited in conjunction with other vulnerabilities. Notably, IPv6 mode is not enabled by default for VMNAT, reducing the vulnerability's exposure.
Affected Version(s)
Fusion 10.x before 10.1.1
Fusion 8.x before 8.5.10
Workstation Pro / Player 14.x before 14.1.1
References
CVSS V3.1
Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved