CVE-2017-4933
Description
VMware ESXi (6.5 before ESXi650-201710401-BG), Workstation (12.x before 12.5.8), and Fusion (8.x before 8.5.9) contain a vulnerability that could allow an authenticated VNC session to cause a heap overflow via a specific set of VNC packets resulting in heap corruption. Successful exploitation of this issue could result in remote code execution in a virtual machine via the authenticated VNC session. Note: In order for exploitation to be possible in ESXi, VNC must be manually enabled in a virtual machine's .vmx configuration file. In addition, ESXi must be configured to allow VNC traffic through the built-in firewall.
How to fix
- vmware workstation_pro12.5.8 or later
- vmware fusion8.5.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vmware workstation_pro | 12.0.0 ≤ v < 12.5.8, 14.0, 14.1.0 | 12.5.8 |
| vmware esxi | 6.5 | — |
| vmware fusion | 8.0.0 ≤ v < 8.5.9 | 8.5.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.