Heap-based buffer overflow in VMware Fusion and VMware Workstation - CVE-2017-4934

Vulnerability identifier: #VU9355

CSH Severity: Low

CVSS v4: 8.7 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-4934

CWE-ID: CWE-122

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to execute arbitrary code on the target system.

The weakness exists due to a heap-based buffer overflow in the VMNAT device. An adjacent attacker can trigger memory corruption and execute arbitrary code with elevated privileges.

VMware Fusion
VMware Workstation

Update Workstation to version 12.5.8.
Update Fusion to 8.5.9.

• https://www.vmware.com/security/advisories/VMSA-2017-0018.html

• Multiple vulnerabilities in VmWare products