CERT-In Vulnerability Note
CIVN-2017-0191
Multiple Vulnerabilities in VMware Products
Original Issue Date:December 29, 2017
Severity Rating: HIGH
Software Affected
- VMware Workstation versions 14.x, 12.x
- VMWare ESXi versions 5.5, 6.0, 6.5
- VMware Fusion versions 8.x, 10.x
- VMware vCSA versions 5.5, 6.0, 6.5
Overview
Multiple vulnerabilities have been reported in VMware products which could be exploited by an attacker to execute arbitrary code, conduct cross site scripting (XSS) attacks, or gain elevated privileges on the affected system.
Description
1. Remote Code Execution Vulnerabilities
(
CVE-2017-4933
CVE-2017-4941
)
These vulnerabilities exist in multiple VMware products due to improper handling of stack and heap memory operations performed by the affected software. A remote attacker could exploit this vulnerability by running specially crafted VNC packets to take control over the affected system.
Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code in the context of authenticated VNC session and result in compromising the system completely.
Note: Successful exploitation of this vulnerability in ESXi, if VNC is enabled in a virtual machines .vmx configuration file. In addition, ESXi must be configured to allow VNC traffic through the built-in firewall.
2. Cross Site Scripting Vulnerability
(
CVE-2017-4940
)
This vulnerability exists in the ESXi Host Client due to improper validation of user-supplied HTML code before displaying the input. A remote attacker could exploit this vulnerability by running a specially crafted JavaScript.
Successful exploitation could allow the attacker to conduct Cross Site Scripting (XSS) attacks on the target system.
3. Privilege escalation vulnerability
(
CVE-2017-4943
)
This vulnerability exists in VMware vCenter Server Appliance (vCSA) where a local attacker could gain root privileges on the target system via a "showlog" plugin.
Successful exploitation could allow the attacker to gain elevated privileges on the targeted system.
Solution
Apply appropriate fixes as issued by vendor in
VMSA-2017-0021
Vendor Information
VMware
https://www.vmware.com/security/advisories/VMSA-2017-0021.html
References
VMware
https://www.vmware.com/security/advisories/VMSA-2017-0021.html
Security Tracker
https://www.securitytracker.com/id/1040025
https://www.securitytracker.com/id/1040024
https://www.securitytracker.com/id/1040026
CVE Name
CVE-2017-4933
CVE-2017-4941
CVE-2017-4940
CVE-2017-4943
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|