CVE-2017-4918 Command injection in Horizon View Client for Mac

Critical 9.8 Published 8 Jun 2017 Updated 5 Aug 2024

Unprivileged users can escalate privileges to root on macOS via command injection in the VMware Horizon View Client startup script.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2017-4918?

CVE-2017-4918 is a critical command injection vulnerability in VMware Horizon View Client for Mac, published on 8 Jun 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

VMware Horizon View Client (2.x, 3.x and 4.x prior to 4.5.0) contains a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.

Weakness: CWE-77

Which versions are affected by CVE-2017-4918?

It affects 1 product.

Products include Vmware Horizon View.

How do I fix CVE-2017-4918?

No fix has been published for CVE-2017-4918 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2017-4918 being exploited?

There is no known exploitation of CVE-2017-4918 in the wild and no public exploit code.

Sources

Also known as GHSA-qr5w-hhfh-gp9g.