Today, VMware has released the following new security advisory:

“VMSA-2018-0028 (https://www.vmware.com/security/advisories/VMSA-2018-0028.html) – VMware vRealize Log Insight updates address an authorization bypass vulnerability”

This documents the remediation of a moderate severity authorization bypass vulnerability (CVE-2018-6980 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6980) in VMware vRealize Log Insight. The issue exists due to improper authorization in the user registration method. Successful exploitation of this issue may allow Admin users with view only permission to perform certain administrative functions which they are not allowed to perform.

We would like to thank Piotr Madej of (ING Tech Poland https://ingtechpoland.com/) for reporting this issue to us.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

Today VMware has released the following new and updated security advisories:

VMSA-2018-0024 – https://www.vmware.com/security/advisories/VMSA-2018-0024.html

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

Today VMware has released the following new security advisory:

VMSA-2018-0023 – AirWatch Agent and VMware Content Locker updates resolve data protection vulnerabilities.

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

Today VMware has released the following new and updated security advisories:

VMSA-2018-0006 – vRealize Automation, vSphere Integrated Containers, and AirWatch Console updates address multiple security vulnerabilities

Please sign up to the Security-Announce mailing list to receive new and updated VMware Security Advisories.

Customers should review the security advisories and direct any questions to VMware Support.

As the first software-defined networking solution with a published STIG, VMware NSX meets the security hardening guidance required for installment on Department of Defense (DoD) networks. The VMware NSX STIG provides the technical security policies, requirements, and implementation details for applying security concepts to NSX. Agencies within the DoD and other Federal Agencies can now deploy NSX with the STIG guidelines to bring IT agility and security to the data center to help save both time and money.

For more details, see the company press release:

http://www.vmware.com/company/news/releases/vmw-newsfeed.Newly-Released-STIG-Validates-VMware-NSX-Meets-the-Security-Hardening-Guidance-Required-for-Installment-on-Department-of-Defense-%28DoD%29-Networks.2093065.html

The VMware Center for Policy & Compliance (CP&C) team is pleased to announce the release of a compliance toolkit for blocking the ‘Get Windows 10’ application on all applicable machines.

Microsoft is set to release Windows 10 on July 29th, and will also be available as a free upgrade for applicable systems via the ‘Get Windows 10’ application. In the Enterprise environment, it is important to maintain control over your devices, and the ‘Get Windows 10’ application can cause quite a stir in the corporate environment. There is however relief for those Administrators who wish to smite the application from their environment to ensure that there are no unplanned upgrades.

The “Blocker for ‘Get Windows 10’ application” compliance template in VMware vRealize Configuration Manager (VCM) provides an option to quickly check and enforce remediation to prevent any unplanned upgrade of Windows. The enforcement checks and creates an registry key if needed, and then an registry value to disable the GWX application, which provides an option to upgrade the existing version of Windows.

VMware vRealize Configuration Manager is not limited to compliance. This solution supports configuration and compliance assessment of your Docker containers, *NIX, Windows and Virtual environments along with patching, change management and various other asset management and reporting capabilities. It also support other regulatory and industry accepted security benchmarks and guidelines such as HIPAA, PCIDSS, DISA, CIS, IRS, SOX, etc. If you have any questions about this solution, please post them here.

Thanks and Regards,
Aravind Kolipakkam
CISSP | CCSK | ITIL | MCSE | Security+