Security updates released on Thursday by VMware for its vCloud Director, ESXi, Workstation and Fusion products patch several vulnerabilities, including ones disclosed recently at the Pwn2Own 2019 hacking competition.
At Pwn2Own 2019, Amat Cama and Richard Zhu of team Fluoroacetate demonstrated two VMware Workstation vulnerabilities, including one that was leveraged in a complex exploit targeting Microsoft’s Edge browser. They earned $70,000 for escaping a VMware Workstation virtual machine and executing code on the underlying host operating system, and $130,000 for the Edge exploit.
Updates released by VMware this week for ESXi, Workstation, and Fusion (only on macOS) address these flaws. The vendor has described the issues as an out-of-bounds read/write vulnerability and a Time-of-Check-Time-of-Use (TOCTOU) bug in the virtual USB 1.1 Universal Host Controller Interface (UHCI). The CVE identifiers CVE-2019-5518 and CVE-2019-5519 have been assigned to these vulnerabilities, with both classified as “critical.”
VMware has also patched a critical out-of-bounds write vulnerability in the e1000 virtual network adapter used by Workstation and Fusion (only on macOS). The security hole, discovered by Zhangyanyu of Chinese company Chaitin Tech, can allow a guest to execute arbitrary code on the host. This issue is tracked as CVE-2019-5524.
A similar flaw affecting Workstation and Fusion was identified by ZhanluLab in the e1000 and e1000e virtual network adapters. While exploiting this weakness can lead to code execution on the host from the guest operating system, the more likely outcome is a denial-of-service (DoS) condition on the guest. A severity rating of “important” has been assigned to this issue.
VMware informed customers that Fusion 11.x running on macOS is affected by a critical vulnerability tracked as CVE-2019-5514. The flaw was reported independently to the company by a Chinese researcher who uses the online moniker CodeColorist and Hungary-based researcher Csaba Fitzl.
“VMware Fusion contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines,” VMware explained in its advisory.
In a separate advisory published on Thursday, VMware described a critical vulnerability affecting VMware vCloud Director for Service Providers. The flaw, tracked as CVE-2019-5523, impacts vCD 9.5.x on any platform and it allows a remote attacker to hijack sessions for the Tenant and Provider portals by impersonating a currently logged-in session.
Related: VMware Patches Code Execution Flaw in Virtual Graphics Card
Related: VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- UK Car Retailer Arnold Clark Hit by Ransomware
- EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
- Google Fi Data Breach Reportedly Led to SIM Swapping
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
- Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
Latest News
- F5 Working on Patch for BIG-IP Flaw That Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- UK Car Retailer Arnold Clark Hit by Ransomware
- Dealing With the Carcinization of Security
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Cyber Insights 2023 | Supply Chain Security
- Cyber Insights 2023: Regulations
- Cyber Insights 2023: Ransomware
