VMware has published two security advisories on Tuesday to inform customers of patches that address information disclosure vulnerabilities in several of the company’s products.
One of the advisories describes three important flaws affecting VMware vCenter Server, vSphere Client and vRealize Automation. Researchers from Positive Technologies discovered XML External Entity (XXE) vulnerabilities that can lead to information disclosure and, in some cases, to a denial-of-service (DoS) condition.
One issue is related to the single sign-on functionality, while another affects the Log Browser, the Distributed Switch setup and the Content Library. An attacker can exploit the flaws using specially crafted XML requests sent to the server.
The third XXE bug impacts the vSphere Client and it can be exploited if the attacker can trick a legitimate user into connecting to a malicious vCenter Server or ESXi instance.
The security holes, tracked as CVE-2016-7458, CVE-2016-7459 and CVE-2016-7460, have been patched with the release of vSphere Client 6.0 U2s and 5.5 U3e, vCenter Server 6.0 U2s and 5.5 U3e, and vRealize Automation 6.2.5. In the case of vSphere Client, VMware recommends uninstalling the application and reinstalling a patched version.
The second advisory published this week by VMware describes CVE-2016-5334, a moderate-severity information disclosure flaw in Identity Manager and vRealize Automation. The vendor noted that the weakness, which is similar to a directory traversal, can allow an attacker to only access folders that don’t contain any sensitive data.
The security holes have been fixed in Identity Manager 2.7.1 and vRealize Automation 7.2.0. vRealize Automation 7.x is affected by this bug as it includes an RPM-based version of Identity Manager.
VMware also informed customers that it has updated two advisories, including the one covering the Linux kernel flaw known as Dirty COW.
Earlier this month, white hat hackers who took part in the PwnFest competition in South Korea managed to find a critical VMware Workstation vulnerability that can be exploited from the guest to execute arbitrary code on the host operating system. The organizers awarded the researchers $150,000 for their guest-to-host escape.
Related: VMware Flaws Allow Security Bypass on Mac OS X
Related: VMware Patches Directory Traversal Flaw in Horizon View
Related: Flaws Allow Attackers to Hijack VMware vRA Appliances