Security Experts:

Connect with us

Hi, what are you looking for?



Information Disclosure Flaws Patched in VMware Products

VMware has published two security advisories on Tuesday to inform customers of patches that address information disclosure vulnerabilities in several of the company’s products.

VMware has published two security advisories on Tuesday to inform customers of patches that address information disclosure vulnerabilities in several of the company’s products.

One of the advisories describes three important flaws affecting VMware vCenter Server, vSphere Client and vRealize Automation. Researchers from Positive Technologies discovered XML External Entity (XXE) vulnerabilities that can lead to information disclosure and, in some cases, to a denial-of-service (DoS) condition.

One issue is related to the single sign-on functionality, while another affects the Log Browser, the Distributed Switch setup and the Content Library. An attacker can exploit the flaws using specially crafted XML requests sent to the server.

The third XXE bug impacts the vSphere Client and it can be exploited if the attacker can trick a legitimate user into connecting to a malicious vCenter Server or ESXi instance.

The security holes, tracked as CVE-2016-7458, CVE-2016-7459 and CVE-2016-7460, have been patched with the release of vSphere Client 6.0 U2s and 5.5 U3e, vCenter Server 6.0 U2s and 5.5 U3e, and vRealize Automation 6.2.5. In the case of vSphere Client, VMware recommends uninstalling the application and reinstalling a patched version.

The second advisory published this week by VMware describes CVE-2016-5334, a moderate-severity information disclosure flaw in Identity Manager and vRealize Automation. The vendor noted that the weakness, which is similar to a directory traversal, can allow an attacker to only access folders that don’t contain any sensitive data.

The security holes have been fixed in Identity Manager 2.7.1 and vRealize Automation 7.2.0. vRealize Automation 7.x is affected by this bug as it includes an RPM-based version of Identity Manager.

VMware also informed customers that it has updated two advisories, including the one covering the Linux kernel flaw known as Dirty COW.

Earlier this month, white hat hackers who took part in the PwnFest competition in South Korea managed to find a critical VMware Workstation vulnerability that can be exploited from the guest to execute arbitrary code on the host operating system. The organizers awarded the researchers $150,000 for their guest-to-host escape.

Related: VMware Flaws Allow Security Bypass on Mac OS X

Related: VMware Patches Directory Traversal Flaw in Horizon View

Related: Flaws Allow Attackers to Hijack VMware vRA Appliances

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.