Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cloud Security

VMware Patches Flaws Disclosed at Pwn2Own 2019

Security updates released on Thursday by VMware for its vCloud Director, ESXi, Workstation and Fusion products patch several vulnerabilities, including ones disclosed recently at the Pwn2Own 2019 hacking competition.

Security updates released on Thursday by VMware for its vCloud Director, ESXi, Workstation and Fusion products patch several vulnerabilities, including ones disclosed recently at the Pwn2Own 2019 hacking competition.

At Pwn2Own 2019, Amat Cama and Richard Zhu of team Fluoroacetate demonstrated two VMware Workstation vulnerabilities, including one that was leveraged in a complex exploit targeting Microsoft’s Edge browser. They earned $70,000 for escaping a VMware Workstation virtual machine and executing code on the underlying host operating system, and $130,000 for the Edge exploit.

Updates released by VMware this week for ESXi, Workstation, and Fusion (only on macOS) address these flaws. The vendor has described the issues as an out-of-bounds read/write vulnerability and a Time-of-Check-Time-of-Use (TOCTOU) bug in the virtual USB 1.1 Universal Host Controller Interface (UHCI). The CVE identifiers CVE-2019-5518 and CVE-2019-5519 have been assigned to these vulnerabilities, with both classified as “critical.”

VMware has also patched a critical out-of-bounds write vulnerability in the e1000 virtual network adapter used by Workstation and Fusion (only on macOS). The security hole, discovered by Zhangyanyu of Chinese company Chaitin Tech, can allow a guest to execute arbitrary code on the host. This issue is tracked as CVE-2019-5524.

A similar flaw affecting Workstation and Fusion was identified by ZhanluLab in the e1000 and e1000e virtual network adapters. While exploiting this weakness can lead to code execution on the host from the guest operating system, the more likely outcome is a denial-of-service (DoS) condition on the guest. A severity rating of “important” has been assigned to this issue.

VMware informed customers that Fusion 11.x running on macOS is affected by a critical vulnerability tracked as CVE-2019-5514. The flaw was reported independently to the company by a Chinese researcher who uses the online moniker CodeColorist and Hungary-based researcher Csaba Fitzl.

“VMware Fusion contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines,” VMware explained in its advisory.

In a separate advisory published on Thursday, VMware described a critical vulnerability affecting VMware vCloud Director for Service Providers. The flaw, tracked as CVE-2019-5523, impacts vCD 9.5.x on any platform and it allows a remote attacker to hijack sessions for the Tenant and Provider portals by impersonating a currently logged-in session.

Related: VMware Patches Code Execution Flaw in Virtual Graphics Card

Related: VMware Patches VM Escape Flaw Disclosed at Chinese Hacking Contest

Related: New VMware Firewall Focuses on Known Good Behavior

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.