VMware discloses critical zero-day vulnerability in Workspace One

guest · Nov 23, 2020

VMware discloses critical zero-day vulnerability in Workspace One
November 23, 2020
https://www.bleepingcomputer.com/ne...ical-zero-day-vulnerability-in-workspace-one/

VMware has released a workaround to address a critical zero-day in multiple VMware Workspace One components that allows attackers to execute commands on the host Linux and Windows operating systems using escalated privileges.
Not all versions are vulnerable
The vulnerability tracked as CVE-2020-4006 is a command injection bug — with a 9.1/10 CVSSv3 severity rating — found in the administrative configurator of some releases of VMware Workspace ONE Access, Access Connector, Identity Manager, and Identity Manager Connector.

"A malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account can execute commands with unrestricted privileges on the underlying operating system," according to VMware's advisory.
Click to expand...

Temporary workaround available
While VMware is still working on releasing security updates to address the zero-day vulnerability, the company does provide admins with a temporary workaround designed to fully remove the attack vector on affected systems and prevent exploitation of CVE-2020-4006.

Full details on how to implement and revert the workarounds on Linux-based appliances and Windows-based servers are available HERE.
The Cybersecurity and Infrastructure Security Agency (CISA) also urges admins and users to apply the workarounds issued by VMware to block attackers from potentially taking over impacted systems.
Click to expand...

guest · Nov 23, 2020

VMware Releases Workarounds for CVE-2020-4006
November 23, 2020
https://us-cert.cisa.gov/ncas/current-activity/2020/11/23/vmware-releases-workarounds-cve-2020-4006

VMware has released workarounds to address a vulnerability—CVE-2020-4006—in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. An attacker could exploit this vulnerability to take control of an affected system.

The Cybersecurity and Infrastructure Security Agency encourages users and administrators to review VMware Security Advisory VMSA-2020-0027 and apply the necessary workarounds.
Click to expand...

guest · Nov 25, 2020

CERT Coordination Center - CERT/CC
VMware Workspace ONE Access and related components are vulnerable to command injection
Vulnerability Note VU#724367
November 23, 2020
https://kb.cert.org/vuls/id/724367

Overview
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector are vulnerable to command injection in the administrative configurator. This could allow a remote attacker to execute commands with unrestricted privileges on the underlying operating system.
Description
VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector are vulnerable to command injection in the administrative configurator. This could allow a remote attacker with access to the administrative configurator on port 8443 and a valid password to execute commands with unrestricted privileges on the underlying operating system. For additional details, please see VMware's security advisory.
Click to expand...

Impact
This could allow a malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account to execute commands with unrestricted privileges on the underlying operating system.
Solution
The CERT/CC is currently unaware of a practical solution to this problem.
Click to expand...

guest · Dec 4, 2020

VMware fixes zero-day vulnerability reported by the NSA
December 4, 2020
https://www.bleepingcomputer.com/ne...s-zero-day-vulnerability-reported-by-the-nsa/

VMware has released security updates to address a zero-day vulnerability in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector.

The vulnerability is a command injection bug tracked as CVE-2020-4006 and publicly disclosed two weeks ago.
While it did not issue any security updates at the time it disclosed the zero-day, VMware provided a workaround to help admins mitigate the bug on affected devices.
Click to expand...

While initially, the company didn't disclose the identity of the organization or researcher who reported the vulnerability, VMware acknowledged the US Defense Department's intelligence agency contribution in an update to the security advisory made on Thursday.

VMware also lowered the bug's CVSSv3 base score to 7.2/10 and the maximum severity rating from 'Critical' to 'Important.'
Click to expand...

VMware released security updates that fully mitigate the vulnerability on devices running one of the affected products.
Click to expand...

guest · Dec 7, 2020

NSA: Russian state hackers exploit new VMware vulnerability to steal data
December 7, 2020
https://www.bleepingcomputer.com/ne...ploit-new-vmware-vulnerability-to-steal-data/

The National Security Agency (NSA) warns that Russian state-sponsored threat actors are exploiting a recently patched VMware vulnerability to steal sensitive information after deploying web shells on vulnerable servers.

"NSA encourages National Security System (NSS), Department of Defense (DoD), and Defense Industrial Base (DIB) network administrators to prioritize mitigation of the vulnerability on affected servers," the US Defense Department's intelligence agency said.
When asked to provide more information on the targets compromised in these attacks, the NSA told BleepingComputer that it "does not publicly share details on victims of foreign malicious cyber activity."

The NSA also refrained from providing further information about the start date of these attacks saying that "[w]e don’t provide specifics on the source of any particular information so we can continue to fulfill our vital role for the nation, including the development and sharing of technical guidance like this report."
Click to expand...

Security updates and workaround available
VMware released security updates to address the security bug on December 3rd after publicly disclosing the vulnerability two weeks ago and providing a temporary workaround that fully removes the attack vector and prevents exploitation.
Click to expand...

guest · Dec 8, 2020

NSA Releases Advisory on Russian State-Sponsored Malicious Cyber Actors Exploiting CVE-2020-4006
December 7, 2020
https://us-cert.cisa.gov/ncas/curre...isory-russian-state-sponsored-malicious-cyber

The National Security Agency (NSA) has released a Cybersecurity Advisory on Russian state-sponsored actors exploiting CVE-2020-4006, a command-injection vulnerability in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. The actors were found exploiting this vulnerability to access protected data on affected systems. The NSA advisory provides mitigation and detection guidance.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the following resources and apply the necessary updates and detection guidance.

NSA Cybersecurity Advisory Russian State-Sponsored Actors Exploiting Vulnerability in VMware Workspace ONEAccess Using Compromised Credentials

VMware Security Advisory VMSA-2020-0027.2

CERT Coordination Center (CERT/CC) Vulnerability Note VU#724367

Click to expand...

Log in or Sign up

VMware discloses critical zero-day vulnerability in Workspace One

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

VMware discloses critical zero-day vulnerability in Workspace One

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches