Detections
Analytics
ESXi 5.5 / 6.0 / 6.5 / Multiple Vulnerabilities (VMSA-2017-0021) (VMSA-2018-0002) (Spectre) (remote check)
high Nessus Plugin ID 105486
Language:
Synopsis
The remote VMware ESXi host is affected by multiple vulnerabilities.Description
The remote VMware ESXi host is version 5.5, 6.0, or 6.5 and is missing a security patch. It is, therefore, affected by multiple vulnerabilities that can allow code execution in a virtual machine via the authenticated VNC session as well as cause information disclosure from one virtual machine to another virtual machine on the same host.Solution
Apply the appropriate patch as referenced in the vendor advisory.See Also
https://www.vmware.com/security/advisories/VMSA-2017-0021.html
https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0369
https://www.vmware.com/us/security/advisories/VMSA-2018-0002.html
Plugin Details
Severity: High
ID: 105486
File Name: vmware_esxi_VMSA-2017-0021.nasl
Version: 1.12
Type: remote
Family: Misc.
Published: 12/29/2017
Updated: 9/2/2020
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: High
Score: 8.4
CVSS v2
Risk Factor: Medium
Base Score: 6
Temporal Score: 5.2
Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:P
CVSS Score Source: CVE-2017-4941
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 7.2
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:H/RL:O/RC:C
Vulnerability Information
CPE: cpe:/o:vmware:esxi
Required KB Items: Host/VMware/release, Host/VMware/version, Host/VMware/vsphere
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 12/19/2017
Vulnerability Publication Date: 12/19/2017
Exploitable With
CANVAS (CANVAS)
Reference Information
CVE: CVE-2017-4940, CVE-2017-4941, CVE-2017-5715, CVE-2017-5753