SB2018072303 - Multiple vulnerabilities in VMware Workstation and Fusion

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2018072303

SB2018072303 - Multiple vulnerabilities in VMware Workstation and Fusion

Published: July 23, 2018

Security Bulletin ID SB2018072303
Severity
Low
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Adjecent network
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Information disclosure (CVE-ID: CVE-2018-6971)

The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.

The vulnerability exists due to the system logs authentication credentials in the 'vmmsi.log' log file when an account other than the current user account is specified during installation. A local attacker can view the passwords.


2) Null pointer dereference (CVE-ID: CVE-2018-6972)

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The vulnerability exists due to NULL pointer dereference in the RPC handler. An adjacent attacker can cause the virtual machine to crash.


Remediation

Install update from vendor's website.

References