Input validation error in VMware Fusion and VMware Workstation - CVE-2019-5535
Published: September 21, 2019
Vulnerability identifier: #VU21242
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-5535
CWE-ID: CWE-20
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of IPV6 network traffic. A local user on guest OS can send specially crafted IPV6 packets and disallow network connectivity for all guest machines using VMware NAT mode.
Successful exploitation of this vulnerability requires that VMNAT is enabled.
Affected software
VMware Fusion
VMware Workstation
VMware Workstation
How to mitigate CVE-2019-5535
Install updates from vendor's website.
VMware Fusion - update to 11.5.0
VMware Workstation - update to 15.5.0
VMware Workstation - update to 15.5.0