CVE-2017-4907 Memory corruption in Horizon View

Critical 9.8 Published 8 Jun 2017 Updated 5 Aug 2024

A heap buffer overflow in VMware Unified Access Gateway and Horizon View allows remote attackers to execute arbitrary code on the security gateway.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-4907?

CVE-2017-4907 is a critical memory corruption vulnerability in VMware Horizon View, published on 8 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

VMware Unified Access Gateway (2.5.x, 2.7.x, 2.8.x prior to 2.8.1) and Horizon View (7.x prior to 7.1.0, 6.x prior to 6.2.4) contain a heap buffer-overflow vulnerability which may allow a remote attacker to execute code on the security gateway.

Weakness: CWE-119

Which versions are affected by CVE-2017-4907?

It affects 2 products.

Products include Vmware Horizon View, Vmware Unified Access Gateway.

How do I fix CVE-2017-4907?

No fix has been published for CVE-2017-4907 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2017-4907 being exploited?

There is no known exploitation of CVE-2017-4907 in the wild and no public exploit code.

Sources

Also known as GHSA-3f8w-p3m8-mpjx.