CVE-2018-6983 : VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x

VMware Workstation (15.x before 15.0.2 and 14.x before 14.1.5) and Fusion (11.x before 11.0.2 and 10.x before 10.1.5) contain an integer overflow vulnerability in the virtual network devices. This issue may allow a guest to execute code on the host.

Published 2018-11-27 17:29:01

Updated 2018-12-19 19:26:03

Source VMware

View at NVD, CVE.org

Vulnerability category: OverflowExecute code

Products affected by CVE-2018-6983

Vmware » Workstation
Versions from including (>=) 15.0.0 and before (<) 15.0.2
cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*
Matching versions
Vmware » Workstation
Versions from including (>=) 14.0.0 and before (<) 14.1.5
cpe:2.3:a:vmware:workstation:*:*:*:*:*:*:*:*
Matching versions
Vmware » Fusion
Versions from including (>=) 11.0.0 and before (<) 11.0.2
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: N/A
Vmware » Fusion
Versions from including (>=) 10.0.0 and before (<) 10.1.5
cpe:2.3:a:vmware:fusion:*:*:*:*:*:*:*:*
Matching versions
When used together with: Apple » Mac Os X » Version: N/A

Threat overview for CVE-2018-6983

Top countries where our scanners detected CVE-2018-6983

Top open port discovered on systems with this issue 443

IPs affected by CVE-2018-6983 1,717

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2018-6983!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2018-6983

EPSS FAQ

0.05%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 12 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-6983

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	2.0	6.0	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Changed Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2018-6983

CWE-190 Integer Overflow or Wraparound

The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-6983

https://www.vmware.com/security/advisories/VMSA-2018-0030.html

VMSA-2018-0030
Vendor Advisory
http://www.securityfocus.com/bid/105986

VMware Workstation and Fusion CVE-2018-6983 Local Integer Overflow Vulnerability
Third Party Advisory;VDB Entry