Home > Blogs > VMware Security & Compliance Blog > Monthly Archives: November 2018

Monthly Archives: November 2018

New VMware Security Advisory VMSA-2018-0029

On November 20th 2018 VMware released the following new security advisory:

VMSA-2018-0029 – vSphere Data Protection (VDP) updates address multiple security issues.

This documents several critical, important and moderate severity issues affecting VDP. VDP is based on Dell EMC Avamar Virtual Edition.

Issue (a) is a critical severity remote code execution vulnerability (CVE-2018-11066). A remote unauthenticated attacker could potentially exploit this vulnerability to execute arbitrary commands on the server.

Issue (b) is an important severity open redirection vulnerability (CVE-2018-11067). A remote unauthenticated attacker could potentially exploit this vulnerability to redirect application users to arbitrary web URLs by tricking the victim users to click on maliciously crafted links. The vulnerability could be used to conduct phishing attacks that cause users to unknowingly visit malicious sites.

Issue (c) is an important severity information exposure vulnerability (CVE-2018-11076). VDP Java management console’s SSL/TLS private key may be leaked in the VDP Java management client package. The private key could potentially be used by an unauthenticated attacker on the same data-link layer to initiate a MITM attack on management console users.

Issue (d) is a moderate severity command injection vulnerability (CVE-2018-11077). The ‘getlogs’ troubleshooting utility in VDP contains an OS command injection vulnerability. A malicious admin user may potentially be able to execute arbitrary commands under root privilege.

These issues have been addressed in VDP 6.1.10, 6.1.9 and 6.0.9.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

VMware and the Tianfu Cup PWN Contest

Update November 22, 2018 – Release of VMware Security Advisory VMSA-2018-0030
Today VMware has released the following new security advisory:

VMSA-2018-0030 – VMware Workstation and Fusion updates address an integer overflow issue.

The advisory documents the remediation of the critical severity vulnerability which was demonstrated at the Tianfu Cup PWN Contest.
This issue affects VMware Workstation and VMware Fusion, and may allow a guest to execute code on the host.

Customers should review the security advisory and direct any questions to VMware Support.

Update November 17, 2018
The Tianfu Cup PWN Contest has wrapped up after Day 2. No additional teams targeted VMware Workstation on Day 2.

We are actively working on remediation, of the issue reported on Day 1, for VMware Workstation and Fusion.
VMware vSphere ESXi is unaffected.
We plan on publishing a VMware Security Advisory to provide information on updates for affected products.
As always please sign up for our VMware Security Advisories here for new and updated information.

Update November 16, 2018
Day 1 of the Tianfu Cup PWN Contest has finished in Chengdu. VMware Workstation is a target at this competition.

One researcher has shown that he could execute code on the VMware Workstation host from the guest. We are currently investigating the issue after having received the details. We are actively working on its remediation and we plan on publishing a VMware Security Advisory to provide information on updates for affected products.

We would like to thank the Tianfu Cup organisers and VictorV for working with us to address the issue.

Original Post
We wanted to post a quick acknowledgement that VMware has representatives in attendance at the Tianfu Cup PWN Contest in Chengdu, China to review any vulnerabilities that may be demonstrated during the contest.

We would like to thank the organisers for inviting us to attend. Stay tuned for further updates.

As always please sign up for our VMware Security Advisories here for new and updated information.

New VMware Security Advisory VMSA-2018-0028

Today, VMware has released the following new security advisory:

 

“VMSA-2018-0028 (https://www.vmware.com/security/advisories/VMSA-2018-0028.html) – VMware vRealize Log Insight updates address an authorization bypass vulnerability”

This documents the remediation of a moderate severity authorization bypass vulnerability (CVE-2018-6980 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6980) in VMware vRealize Log Insight. The issue exists due to improper authorization in the user registration method. Successful exploitation of this issue may allow Admin users with view only permission to perform certain administrative functions which they are not allowed to perform.

We would like to thank Piotr Madej of (ING Tech Poland https://ingtechpoland.com/) for reporting this issue to us.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

VMware and the GeekPwn2018 event – new VMware Security Advisory VMSA-2018-0027


Update November 9, 2018 – Release of VMware Security Advisory VMSA-2018-0027

Today, VMware has released the following new security advisory:

VMSA-2018-0027 VMware ESXi, Workstation, and Fusion updates address uninitialized stack memory usage

The advisory documents the remediation of the critical and important security vulnerabilities that were demonstrated in the GeekPwn2018 event. These issues affect ESXi, VMware Workstation, and VMware Fusion, and may allow a guest to execute code on the host.

Customers should review the security advisory and direct any questions to VMware Support.

Original post
VMware is aware of the security vulnerability that was demonstrated at the GeekPwn2018 event. We have been in contact with the organizers of GeekPwn2018 and they have provided us with the details of the issue. We are actively working on its remediation and we plan on publishing a VMware Security Advisory to provide information on updates for affected products.

Please sign up for VMware Security Advisories (here) to be notified when this advisory and future advisories are published.

We would like to thank the organizers of GeekPwn2018 and security researcher Zhangyanyu for working with us on responsible disclosure of this issue.