Vulnerabilities

VMware Patches Directory Traversal Flaw in Horizon View

VMware has released updates for the Windows versions of its Horizon View product to address an important vulnerability that could lead to information disclosure.

Eduard Kovacs

October 7, 2016

VMware has released updates for the Windows versions of its Horizon View product to address an important vulnerability that could lead to information disclosure.

Security researcher Mike Arnold, known online as “Bruk0ut,” discovered that the desktop virtualization product is plagued by a flaw that could allow a directory traversal on the Horizon View Connection Server. A remote attacker can exploit this weakness to gain access to some potentially sensitive information.

The flaw, tracked as CVE-2016-7087, was reported by Arnold via Trend Micro’s Zero-Day Initiative (ZDI). ZDI has yet to make its advisory public, despite the fact that 160 days have passed since the initial report. The company typically discloses vulnerabilities after 120 days, but it is possible that VMware requested an extension of that deadline.

The security hole affects VMware Horizon View versions 5.x, 6.x and 7.x for Windows. The issue has been addressed with the release of versions 7.0.1, 6.2.3 and 5.3.7.

VMware has rated the vulnerability “important,” while ZDI has assigned it a CVSS score of 5.8, which puts it in the “medium” severity category.

VMware has released this year over a dozen rounds of security patches, including for vulnerabilities in ESXi, Fusion, Player, Workstation, vCenter, vRealize, NSX, vCNS and Identity Manager. However, this is the first security update released by the company in 2016 for the Horizon View product.

Written By Eduard Kovacs

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Latest News

Click to comment

How the Atomized Network Changed Enterprise Protection

Our networks have become atomized which, for starters, means they’re highly dispersed. Not just in terms of the infrastructure – legacy, on-premises, hybrid, multi-cloud, and edge.

Matt Wilson

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar