CVE-2017-4934
VMware Workstation NAT IP Fragment Reassembly Heap-based Buffer Overflow Privilege Escalation Vulnerability
Severity Score
8.8
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
VMware Workstation (12.x before 12.5.8) and Fusion (8.x before 8.5.9) contain a heap buffer-overflow vulnerability in VMNAT device. This issue may allow a guest to execute code on the host.
VMware Workstation (en versiones 12.x anteriores a la 12.5.8) y Fusion (en versiones 8.x anteriores a la 8.5.9) contienen una vulnerabilidad de desbordamiento de búfer basado en memoria dinámica (heap) en el dispositivo VMNAT. Este problema puede permitir que un invitado ejecute código en el host.
This vulnerability allows local attackers to execute arbitrary code on vulnerable installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the handling of the NAT IP Fragment Reassembly. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length heap-based buffer. An attacker can leverage this vulnerability to elevate privileges and execute arbitrary code under the context of SYSTEM in the host OS.
*Credits:
Jun Mao of Tencent PC Manager
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-12-26 CVE Reserved
- 2017-11-17 CVE Published
- 2023-09-27 EPSS Updated
- 2024-09-16 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/101903 | Third Party Advisory | |
| http://www.securitytracker.com/id/1039835 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://www.vmware.com/security/advisories/VMSA-2017-0018.html | 2017-12-03 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.0.0 Search vendor "Vmware" for product "Workstation" and version "12.0.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.0.1 Search vendor "Vmware" for product "Workstation" and version "12.0.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.1 Search vendor "Vmware" for product "Workstation" and version "12.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.1.1 Search vendor "Vmware" for product "Workstation" and version "12.1.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.5 Search vendor "Vmware" for product "Workstation" and version "12.5" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.5.1 Search vendor "Vmware" for product "Workstation" and version "12.5.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.5.2 Search vendor "Vmware" for product "Workstation" and version "12.5.2" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.5.3 Search vendor "Vmware" for product "Workstation" and version "12.5.3" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.5.4 Search vendor "Vmware" for product "Workstation" and version "12.5.4" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.5.5 Search vendor "Vmware" for product "Workstation" and version "12.5.5" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.5.6 Search vendor "Vmware" for product "Workstation" and version "12.5.6" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Workstation Search vendor "Vmware" for product "Workstation" | 12.5.7 Search vendor "Vmware" for product "Workstation" and version "12.5.7" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.0.0 Search vendor "Vmware" for product "Fusion" and version "8.0.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.0.1 Search vendor "Vmware" for product "Fusion" and version "8.0.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.0.2 Search vendor "Vmware" for product "Fusion" and version "8.0.2" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.1.0 Search vendor "Vmware" for product "Fusion" and version "8.1.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.1.1 Search vendor "Vmware" for product "Fusion" and version "8.1.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.5.0 Search vendor "Vmware" for product "Fusion" and version "8.5.0" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.5.1 Search vendor "Vmware" for product "Fusion" and version "8.5.1" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.5.2 Search vendor "Vmware" for product "Fusion" and version "8.5.2" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.5.3 Search vendor "Vmware" for product "Fusion" and version "8.5.3" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.5.4 Search vendor "Vmware" for product "Fusion" and version "8.5.4" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.5.5 Search vendor "Vmware" for product "Fusion" and version "8.5.5" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.5.6 Search vendor "Vmware" for product "Fusion" and version "8.5.6" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.5.7 Search vendor "Vmware" for product "Fusion" and version "8.5.7" | - |
Affected
| ||||||
| Vmware Search vendor "Vmware" | Fusion Search vendor "Vmware" for product "Fusion" | 8.5.8 Search vendor "Vmware" for product "Fusion" and version "8.5.8" | - |
Affected
| ||||||