VMware has released two sets of patches for its software products. In total, VMware patched six vulnerabilities.
The first set of updates covers a number of serious vulnerabilities in the components of the vSphere cloud platform and the vCenter Server management system. The latter contains patches for several applications, including Workstation Pro, Horizon Client, and Remote Console.The most serious vulnerability CVE-2019-5527, which received a score of 8.5 points on the CVSS scale, is associated with an error in the use of RAM after release. The bug is contained in the sound processing component of the following VMware products: ESXi cloud hypervisor versions 6.0, 6.5 and 6.7.
- Fusion Workstation Solution.
- Workstation Pro virtual client.
- Remote VMRC console version 10 for Windows and Linux.
- Horizon Client 5.x for Windows, Linux, and macOS.
Read also: Google has released an emergency update for Chrome
“Exploiting the vulnerability could allow a local attacker with a user level of access to the guest OS to execute their code on the host machine.”- say the developers.
The manufacturer also fixed two vulnerabilities leading to information disclosure in virtual machines deployed through OVF (Open Virtualization Format) objects. The drawback of CVE-2019-5532 is related to VMware vCenter Server version 6.0, 6.5, and 6.7.
“An attacker with access to the virtual machine properties log files can view the credentials specified during the installation of OVF – this is usually a user with root privileges”, – Ola Beyioku, an information security specialist, found out.
The cybercriminals use the vAppConfig property request for the same purpose. Rich Browne reported on vulnerability CVE-2019-5534 to the manufacturer from the company F5 Networks. Both errors were estimated by experts at 7.7 points of CVSS and were fixed in releases of the program 6.0 U3j, 6.5 U3 and 6.7 U3.
In addition, the vendor fixed an old bug detected in the BusyBox UNIX utility and affecting security of the ESXi hypervisor. The cloud system used a vulnerable component that incorrectly sanitized file names, which could entail the execution of third-party commands within the shell. An error with a hazard rating of 6.7 points is registered as CVE-2017-16544 and is fixed in the release of ESXi650-201907101-SG.
Less serious shortcomings associated with unauthorized disclosure of information to ESXi and vSphere components, as well as the triggering of DoS status in Workstation and Fusion products, were rated at 4.2 and 4.7 points, respectively. VMware fixed these errors in the next program updates.
