Vulnerability identifier: #VU13954

Vulnerability risk: Low

CVSSv3.1: 5.7 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2018-6972

CWE-ID: CWE-476

Exploitation vector: Local network

Exploit availability: No

Vulnerable software:
VMware Horizon
Server applications / Virtualization software

Vendor: VMware, Inc

Description

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference in the RPC handler. An adjacent attacker can cause the virtual machine to crash.

Mitigation
Update to version 7.5.1.

Vulnerable software versions

VMware Horizon: 7.5, 7.4, 7.3.2, 7.1, 7.0 - 7.0.3, 7.2

---

External links
http://www.vmware.com/security/advisories/VMSA-2018-0018.html

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.