Vulnerabilities > CVE-2017-4937 - Out-of-bounds Read vulnerability in VMWare Horizon View and Workstation

047910
CVSS 6.9 - MEDIUM
Attack vector
LOCAL
Attack complexity
MEDIUM
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
local
vmware
CWE-125
nessus

Summary

VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in the TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation. In the case of a Horizon View Client, this may allow a View desktop to execute code or perform a Denial of Service on the Windows OS that runs the Horizon View Client. Exploitation is only possible if virtual printing has been enabled. This feature is not enabled by default on Workstation but it is enabled by default on Horizon View Client.

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Overread Buffers
    An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.

Nessus

  • NASL familyWindows
    NASL idVMWARE_HORIZON_VIEW_CLIENT_VMSA_2017_0018.NASL
    descriptionThe version of VMware Horizon View Client installed on the remote host is 4.x prior to 4.6.1. It is, therefore, affected by multiple vulnerabilities including arbitrary code execution or a DoS. Note that Nessus has not tested for these issues but has instead relied only on the application
    last seen2020-06-01
    modified2020-06-02
    plugin id104852
    published2017-11-29
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104852
    titleVMware Horizon View Client 4.x < 4.6.1 Multiple Vulnerabilities (VMSA-2017-0018)
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(104852);
      script_version("1.8");
      script_cvs_date("Date: 2019/11/12");
    
      script_cve_id("CVE-2017-4935", "CVE-2017-4936", "CVE-2017-4937");
      script_bugtraq_id(101902);
      script_xref(name:"VMSA", value:"2017-0018");
      script_xref(name:"ZDI", value:"ZDI-17-922");
    
      script_name(english:"VMware Horizon View Client 4.x < 4.6.1 Multiple Vulnerabilities (VMSA-2017-0018)");
      script_summary(english:"Checks the VMware Horizon View Client version.");
    
      script_set_attribute(attribute:"synopsis", value:
    "A virtualization application installed on the remote host is affected
    by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The version of VMware Horizon View Client installed on the remote host
    is 4.x prior to 4.6.1. It is, therefore, affected by multiple
    vulnerabilities including arbitrary code execution or a DoS.
    
    Note that Nessus has not tested for these issues but has instead
    relied only on the application's self-reported version number.");
      script_set_attribute(attribute:"see_also", value:"https://www.vmware.com/security/advisories/VMSA-2017-0018.html");
      script_set_attribute(attribute:"see_also", value:"http://www.zerodayinitiative.com/advisories/ZDI-17-922/");
      script_set_attribute(attribute:"solution", value:
    "Upgrade to VMware Horizon View Client 4.6.1 or later.");
      script_set_cvss_base_vector("CVSS2#AV:L/AC:M/Au:N/C:C/I:C/A:C");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"cvss_score_source", value:"CVE-2017-4937");
    
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
    
      script_set_attribute(attribute:"vuln_publication_date", value:"2017/11/16");
      script_set_attribute(attribute:"patch_publication_date", value:"2017/11/16");
      script_set_attribute(attribute:"plugin_publication_date", value:"2017/11/29");
    
      script_set_attribute(attribute:"plugin_type", value:"local");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:vmware:horizon_view_client");
      script_end_attributes();
    
      script_category(ACT_GATHER_INFO);
      script_family(english:"Windows");
    
      script_copyright(english:"This script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.");
    
      script_dependencies("vmware_horizon_view_client_installed.nbin");
      script_require_keys("SMB/Registry/Enumerated", "installed_sw/VMware Horizon View Client");
    
      exit(0);
    }
    
    include("vcf.inc");
    
    get_kb_item_or_exit("SMB/Registry/Enumerated");
    
    app_info = vcf::get_app_info(app:"VMware Horizon View Client", win_local:TRUE);
    
    constraints = [{ "min_version" : "4", "fixed_version" : "4.6.1" }];
    
    vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
    
  • NASL familyWindows
    NASL idVMWARE_WORKSTATION_WIN_VMSA_2017_0018.NASL
    descriptionThe version of VMware Workstation installed on the remote Windows host is 12.x prior to 12.5.8. It is, therefore, affected by multiple vulnerabilities including arbitrary code execution and a local DoS.
    last seen2020-06-01
    modified2020-06-02
    plugin id104853
    published2017-11-29
    reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/104853
    titleVMware Workstation 12.x < 12.5.8 Multiple Vulnerabilities (VMSA-2017-0018)