Security updates released on Thursday by VMware for its vCloud Director, ESXi, Workstation and Fusion products patch several vulnerabilities, including ones disclosed recently at the Pwn2Own 2019 hacking competition.
At Pwn2Own 2019, Amat Cama and Richard Zhu of team Fluoroacetate demonstrated two VMware Workstation vulnerabilities, including one that was leveraged in a complex exploit targeting Microsoft’s Edge browser. They earned $70,000 for escaping a VMware Workstation virtual machine and executing code on the underlying host operating system, and $130,000 for the Edge exploit.
Updates released by VMware this week for ESXi, Workstation, and Fusion (only on macOS) address these flaws. The vendor has described the issues as an out-of-bounds read/write vulnerability and a Time-of-Check-Time-of-Use (TOCTOU) bug in the virtual USB 1.1 Universal Host Controller Interface (UHCI). The CVE identifiers CVE-2019-5518 and CVE-2019-5519 have been assigned to these vulnerabilities, with both classified as “critical.”
VMware has also patched a critical out-of-bounds write vulnerability in the e1000 virtual network adapter used by Workstation and Fusion (only on macOS). The security hole, discovered by Zhangyanyu of Chinese company Chaitin Tech, can allow a guest to execute arbitrary code on the host. This issue is tracked as CVE-2019-5524.
A similar flaw affecting Workstation and Fusion was identified by ZhanluLab in the e1000 and e1000e virtual network adapters. While exploiting this weakness can lead to code execution on the host from the guest operating system, the more likely outcome is a denial-of-service (DoS) condition on the guest. A severity rating of “important” has been assigned to this issue.
VMware informed customers that Fusion 11.x running on macOS is affected by a critical vulnerability tracked as CVE-2019-5514. The flaw was reported independently to the company by a Chinese researcher who uses the online moniker CodeColorist and Hungary-based researcher Csaba Fitzl.
“VMware Fusion contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines,” VMware explained in its advisory.
In a separate advisory published on Thursday, VMware described a critical vulnerability affecting VMware vCloud Director for Service Providers. The flaw, tracked as CVE-2019-5523, impacts vCD 9.5.x on any platform and it allows a remote attacker to hijack sessions for the Tenant and Provider portals by impersonating a currently logged-in session.
Related: VMware Patches Code Execution Flaw in Virtual Graphics Card
Related: VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest
Related: New VMware Firewall Focuses on Known Good Behavior
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- Apple Denies Helping US Government Hack Russian iPhones
- Zero-Day in MOVEit File Transfer Software Exploited to Steal Data From Organizations
- Russia Blames US Intelligence for iOS Zero-Click Attacks
- Cisco Acquiring Armorblox for Predictive and Generative AI Technology
- Moxa Patches MXsecurity Vulnerabilities That Could Be Exploited in OT Attacks
- Organizations Warned of Salesforce ‘Ghost Sites’ Exposing Sensitive Information
- Organizations Warned of Backdoor Feature in Hundreds of Gigabyte Motherboards
Latest News
- In Other News: Government Use of Spyware, New Industrial Security Tools, Japan Router Hack
- OpenAI Unveils Million-Dollar Cybersecurity Grant Program
- Galvanick Banks $10 Million for Industrial XDR Technology
- Information of 2.5M People Stolen in Ransomware Attack at Massachusetts Health Insurer
- US, South Korea Detail North Korea’s Social Engineering Techniques
- High-Severity Vulnerabilities Patched in Splunk Enterprise
- Idaho Hospitals Working to Resume Full Operations After Cyberattack
- Enzo Biochem Ransomware Attack Exposes Information of 2.5M Individuals
