VMSA-2017-0006:VMware ESXi, Workstation and Fusion updates address CRITICAL and MEDIUM security issues
23517
26 March 2017
26 March 2017
CLOSED
CRITICAL
CVE-2017-4902,CVE-2017-4903,CVE-2017-4904,CVE-2017-4905
VMSA-2017-0006
VMware ESXi, Workstation and Fusion updates address critical and moderate security issues
VMware Security Advisory
1. Summary
VMware ESXi, Workstation and Fusion updates address critical and moderate
security issues.
2. Relevant Products
- VMware ESXi (ESXi)
- VMware Workstation Pro / Player (Workstation)
- VMware Fusion Pro, Fusion (Fusion)
3. Problem Description
a. ESXi, Workstation, Fusion SVGA memory corruption
ESXi, Workstation, Fusion have a heap buffer overflow and uninitialized stack memory usage in SVGA. These issues may allow a guest to execute code on the host.
VMware would like to thank ZDI and Team 360 Security from Qihoo for reporting these issues to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2017-4902 (heap issue) and CVE-2017-4903 (stack issue) to these issues.
Note: ESXi 6.0 is affected by CVE-2017-4903 but not by CVE-2017-4902.
Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.
VMware Product
Product Version
Running on
Severity
Replace with/ Apply Patch
Mitigation/ Workaround
* Additional ESXi 6.0 patches are provided for customers that are on ESXi 6.0 U1 or ESXi 6.0 U2.
b. ESXi, Workstation, Fusion XHCI uninitialized memory usage
The ESXi, Workstation, and Fusion XHCI controller has uninitialized memory usage. This issue may allow a guest to execute code on the host. The issue is reduced to a Denial of Service of the guest on ESXi 5.5.
VMware would like to thank ZDI and Team Sniper from Tencent Security for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4904 to this issue.
Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.
VMware Product
Product Version
Running on
Severity
Replace with/ Apply Patch
Mitigation/ Workaround
* Additional ESXi 6.0 patches are provided for customers that are on ESXi 6.0 U1 or ESXi 6.0 U2.
c. ESXi, Workstation, and Fusion uninitialized memory usage
ESXi, Workstation, and Fusion have uninitialized memory usage. This issue may lead to an information leak.
VMware would like to thank ZDI and Team Sniper from Tencent Security for reporting this issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2017-4905 to this issue.
Column 5 of the following table lists the action required to remediate the vulnerability in each release, if a solution is available.
VMware Product
Product Version
Running on
Severity
Replace with/ Apply Patch
Mitigation/ Workaround
* Additional ESXi 6.0 patches are provided for customers that are on ESXi 6.0 U1 or ESXi 6.0 U2.
4. Solution
Please review the patch/release notes for your product and version and verify the checksum of your downloaded file.
VMware ESXi 6.5
Downloads:
https://my.vmware.com/group/vmware/patch
Documentation:
http://kb.vmware.com/kb/2149573
VMware ESXi 6.0 patch on top of ESXi 6.0 U3
Downloads:
https://my.vmware.com/group/vmware/patch
Documentation:
http://kb.vmware.com/kb/2149569
VMware ESXi 6.0 patch on top of ESXi 6.0 U2
Downloads:
https://my.vmware.com/web/vmware/details?productId=491&downloadGroup=ESXI60U2
(Click on the above link and scroll down to ESXi600-201703003 Offline Bundle)
Documentation:
http://kb.vmware.com/kb/2149673
VMware ESXi 6.0 patch on top of ESXi 6.0 U1
Downloads:
https://my.vmware.com/web/vmware/details?productId=491&downloadGroup=ESXI60U1B
(Click on the above link and scroll down to ESXi600-201703002 Offline Bundle)
Documentation:
http://kb.vmware.com/kb/2149672
VMware ESXi 5.5
Downloads:
https://my.vmware.com/group/vmware/patch
Documentation:
http://kb.vmware.com/kb/2149577
VMware Workstation Pro 12.5.5
Downloads and Documentation:
https://www.vmware.com/go/downloadworkstation
https://www.vmware.com/support/pubs/ws_pubs.html
VMware Workstation Player 12.5.5
Downloads and Documentation:
https://www.vmware.com/go/downloadplayer
https://www.vmware.com/support/pubs/player_pubs.html
VMware Fusion Pro / Fusion 8.5.6
Downloads and Documentation:
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4902
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4903
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4904
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4905
VMware Knowledge Base article 2149673
http://kb.vmware.com/kb/2149673
VMware Knowledge Base article 2149672
http://kb.vmware.com/kb/2149672
6. Change log
2017-03-28 VMSA-2017-0006
Initial security advisory in conjunction with the release of ESXi patches and VMware Workstation Pro/Player 12.5.5 and VMware Fusion Pro, Fusion 8.5.6 on 2017-03-28.
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
E-mail: [email protected]
PGP key at:
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
VMware Security & Compliance Blog
https://blogs.vmware.com/security
Copyright 2017 VMware Inc. All rights reserved.