{
    "file_item": {
        "filepath": "security-advisories",
        "filename": "Updated-CERT-EU-SA2017.pdf"
    },
    "title": "UPDATE Critical Vulnerabilities in VMWare ESXi, Workstation, and Fusion",
    "serial_number": "2017-007",
    "publish_date": "29-03-2017 13:16:00",
    "description": "VMWare released an advisory for VMWare ESXi, Workstation, and Fusion products [1]. The advisory addresses critical and moderate security issues that may allow a guest system to execute code on the host system (CVE-2017-4902, CVE-2017-4903, and CVE-2017-4904).",
    "url_title": "2017-007",
    "content_markdown": "---\ntitle: 'Critical Vulnerabilities in VMWare ESXi, Workstation, and Fusion'\nversion: '1.1'\nnumber: '2017-007'\ndate: 'March 31, 2017'\n---\n\n_History:_\n\n* _29/03/2017 --- v1.0: Initial publication_\n* _31/03/2017 --- v1.1: Correction regarding VMWare ESXi 5.5_\n\n# Summary\n\nOn March 28, 2017, VMWare released an advisory for VMWare ESXi, Workstation, and Fusion products [1]. The advisory addresses critical and moderate security issues.\n\nCritical vulnerabilities may allow a guest system to execute code on the host system (CVE-2017-4902, CVE-2017-4903, and CVE-2017-4904).\n\nThe other vulnerability (CVE-2017-4905) may lead to information leak from the guest system.\n\nThese vulnerabilities were discovered by two teams (Team Sniper and Qihoo 360) during Pwn2Own event at CanSecWest [2].\n\n# Technical Details\n\nThe discovered vulnerabilities targeting VMWare products are:\n\n* CVE-2017-4902 (critical): Heap overflow leading to arbitrary code execution\n* CVE-2017-4903 (critical): Uninitialized stack value leading to arbitrary code execution\n* CVE-2017-4904 (critical): Uninitialized stack value leading to arbitrary code execution\n* CVE-2017-4905 (moderate): Uninitialized memory read leading to information disclosure\n\n# Vulnerable Systems\n\n* VMWare ESXi 5.5 - CVE-2017-4904 (moderate) and CVE-2017-4905 (moderate)\n* VMWare ESXi 6.0 - all vulnerabilities except CVE-2017-4902\n* VMWare ESXi 6.5 - all vulnerabilities\n* VMware Workstation 12.X - all vulnerabilities\n* VMware Fusion 8.x (OS X) - all vulnerabilities\n\n_Note:_ VMware ESXi 6.0 is not affected by CVE-2017-4902. Furthermore, CVE-2017-4904 only leads to denial of service on VMWare ESXi 5.5 (moderate).\n\n# Recommendations\n\nApply upgrades provided by VMWare for all affected products as soon as possible [1].\n\nNo other workarounds are available.\n\n# References\n\n[1] <https://www.vmware.com/security/advisories/VMSA-2017-0006.html>\n\n[2] <https://blogs.vmware.com/security/2017/03/security-landscape-pwn2own-2017.html>\n",
    "content_html": "<p><em>History:</em></p><ul><li><em>29/03/2017 --- v1.0: Initial publication</em></li><li><em>31/03/2017 --- v1.1: Correction regarding VMWare ESXi 5.5</em></li></ul><h2 id=\"summary\">Summary</h2><p>On March 28, 2017, VMWare released an advisory for VMWare ESXi, Workstation, and Fusion products [1]. The advisory addresses critical and moderate security issues.</p><p>Critical vulnerabilities may allow a guest system to execute code on the host system (CVE-2017-4902, CVE-2017-4903, and CVE-2017-4904).</p><p>The other vulnerability (CVE-2017-4905) may lead to information leak from the guest system.</p><p>These vulnerabilities were discovered by two teams (Team Sniper and Qihoo 360) during Pwn2Own event at CanSecWest [2].</p><h2 id=\"technical-details\">Technical Details</h2><p>The discovered vulnerabilities targeting VMWare products are:</p><ul><li>CVE-2017-4902 (critical): Heap overflow leading to arbitrary code execution</li><li>CVE-2017-4903 (critical): Uninitialized stack value leading to arbitrary code execution</li><li>CVE-2017-4904 (critical): Uninitialized stack value leading to arbitrary code execution</li><li>CVE-2017-4905 (moderate): Uninitialized memory read leading to information disclosure</li></ul><h2 id=\"vulnerable-systems\">Vulnerable Systems</h2><ul><li>VMWare ESXi 5.5 - CVE-2017-4904 (moderate) and CVE-2017-4905 (moderate)</li><li>VMWare ESXi 6.0 - all vulnerabilities except CVE-2017-4902</li><li>VMWare ESXi 6.5 - all vulnerabilities</li><li>VMware Workstation 12.X - all vulnerabilities</li><li>VMware Fusion 8.x (OS X) - all vulnerabilities</li></ul><p><em>Note:</em> VMware ESXi 6.0 is not affected by CVE-2017-4902. Furthermore, CVE-2017-4904 only leads to denial of service on VMWare ESXi 5.5 (moderate).</p><h2 id=\"recommendations\">Recommendations</h2><p>Apply upgrades provided by VMWare for all affected products as soon as possible [1].</p><p>No other workarounds are available.</p><h2 id=\"references\">References</h2><p>[1] <a rel=\"noopener\" target=\"_blank\" href=\"https://www.vmware.com/security/advisories/VMSA-2017-0006.html\">https://www.vmware.com/security/advisories/VMSA-2017-0006.html</a></p><p>[2] <a rel=\"noopener\" target=\"_blank\" href=\"https://blogs.vmware.com/security/2017/03/security-landscape-pwn2own-2017.html\">https://blogs.vmware.com/security/2017/03/security-landscape-pwn2own-2017.html</a></p>",
    "licence": {
        "title": "Creative Commons Attribution 4.0 International (CC-BY 4.0)",
        "link": "https://creativecommons.org/licenses/by/4.0/",
        "restrictions": "https://cert.europa.eu/legal-notice",
        "author": "The Cybersecurity Service for the Union institutions, bodies, offices and agencies"
    }
}