VMware ESXi 6.5 without patch ESXi650-201707101-SG, ESXi 6.0 without patch ESXi600-201706101-SG, ESXi 5.5 without patch ESXi550-201709101-SG, Workstation (12.x before 12.5.3), Fusion (8.x before 8.5.4) contain a NULL pointer dereference vulnerability. This issue occurs when handling guest RPC requests. Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.

The version of VMware Workstation installed on the remote Windows host is 12.x prior to 12.5.7. It is, therefore, affected by the following vulnerabilities:

  - A remote code execution vulnerability exists in VMware     workstation within the SVGA device. An attacker with     user access can exploit this to execute arbitrary     code. (CVE-2017-4924)

  - A denial of service vulnerability exists in VMware     workstation due to a NULL pointer deference when     handling guest RPC requests. An attacker with guest     access can exploit this to crash their VMs.
    NOTE: This vulnerability only affects VMware     Workstation 12.5.2 and below. (CVE-2017-4925)

The version of VMware Workstation installed on the remote Linux host is 12.x prior to 12.5.7. It is, therefore, affected by the following vulnerabilities:

  - A remote code execution vulnerability exists in VMware     workstation within the SVGA device. An attacker with     user access can exploit this to execute arbitrary     code. (CVE-2017-4924)

  - A denial of service vulnerability exists in VMware     workstation due to a NULL pointer deference when     handling guest RPC requests. An attacker with guest     access can exploit this to crash their VMs.
    NOTE: This vulnerability only affects VMware     Workstation 12.5.2 and below. (CVE-2017-4925)

The version of the remote VMware ESXi 6.5 host is prior to build 5969300. It is, therefore, affected by multiple vulnerabilities :

  - An out-of-bounds write error related to SVGA devices     that allows a guest virtual machine to execute code on     the host machine. (CVE-2017-4924)

  - A NULL pointer dereference vulnerability related to     handling RPC requests that could allow an     attacker to crash a virtual machine. (CVE-2017-4925)

The version of the remote VMware ESXi 5.5 host is prior to build 6480267. It is, therefore, affected by a NULL pointer dereference vulnerability related to handling RPC requests that could allow an attacker to crash a virtual machine.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 8.x prior to 8.5.4. It is, therefore, affected by a NULL pointer dereference error related to handling RPC requests that allows an attacker to crash a virtual machine.

a. Out-of-bounds write vulnerability in SVGA

VMware ESXi, Workstation and Fusion contain an out-of-bounds write vulnerability in SVGA device. This issue may allow a guest to execute code on the host.

VMware would like to thank Nico Golde and Ralf-Philipp Weinmann of Comsecuris UG (haftungsbeschraenkt) working with ZDI for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4924 to this issue.

b. Guest RPC NULL pointer dereference vulnerability

VMware ESXi, Workstation and Fusion contain a NULL pointer dereference vulnerability. This issue occurs when handling guest RPC requests.
Successful exploitation of this issue may allow attackers with normal user privileges to crash their VMs.

VMware would like to thank Zhang Haitao for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4925 to this issue.

c. Stored XSS in H5 Client

vCenter Server H5 Client contains a vulnerability that may allow for stored cross-site scripting (XSS). An attacker with VC user privileges can inject malicious java-scripts which will get executed when other VC users access the page.

VMware would like to thank Thomas Ornetzeder for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4926 to this issue.

The version of the remote VMware ESXi 6.0 host is prior to build 5224529. It is, therefore, affected by multiple vulnerabilities in VMWare Tools and the bundled OpenSSL and Python packages, as well as a NULL pointer dereference vulnerability related to handling RPC requests that could allow an attacker to crash a virtual machine.

ID	Name	Product	Family	Type	Severity
103380	VMware Workstation 12.x < 12.5.7 Multiple Vulnerabilities (VMSA-2017-0015)	Nessus	Windows	Local	high
103379	VMware Workstation 12.x < 12.5.7 Multiple Vulnerabilities (VMSA-2017-0015) (Linux)	Nessus	General	Local	high
103376	ESXi 6.5 < Build 5969300 Multiple Vulnerabilities (VMSA-2017-0015) (remote check)	Nessus	Misc.	Remote	high
103375	ESXi 5.5 < Build 6480267 RPC NULL Pointer Dereference Vulnerability (VMSA-2017-0015) (remote check)	Nessus	Misc.	Remote	medium
103373	VMware Fusion 8.x < 8.5.4 DoS Vulnerability (VMSA-2017-0015) (macOS)	Nessus	MacOS X Local Security Checks	Local	medium
103357	VMSA-2017-0015 : VMware ESXi, vCenter Server, Fusion and Workstation updates resolve multiple security vulnerabilities	Nessus	VMware ESX Local Security Checks	Local	high
102698	ESXi 6.0 < Build 5485776 Multiple Vulnerabilities (VMSA-2017-0015) (remote check)	Nessus	Misc.	Remote	high

Detections

Analytics

CVE-2017-4925

medium

Tenable Plugins

high

high

high

medium

medium

high

high