Multiple vulnerabilities in VMware Workstation, Fusion and ESXi
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2019-5527 CVE-2019-5535 CVE-2019-5536 |
| CWE-ID | CWE-416 CWE-20 CWE-248 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
VMware Fusion Client/Desktop applications / Virtualization software VMware Workstation Client/Desktop applications / Virtualization software VMware ESXi Operating systems & Components / Operating system |
| Vendor | VMware, Inc |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
Updated 30.10.2019
Added vulnerability #3, changed bulletin title and severity.
1) Use-after-free
EUVDB-ID: #VU21241
Risk: Medium
CVSSv4.0: 6.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-5527
CWE-ID:
CWE-416 - Use After Free
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise vulnerable system.
The vulnerability exists due to a use-after-free error in the virtual sound device. A local unprivileged user with access to guest operating system can trigger use-after-free error and execute arbitrary code on the host OS.
Successful exploitation of the vulnerability requires that the sound back-end is not connected.
MitigationInstall updates from vendor's website.
Vulnerable software versionsVMware Fusion: 11.0.0 - 11.1.1
VMware Workstation: 15.0.0 - 15.1.0
CPE2.3- cpe:2.3:a:vmware:vmware_fusion:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_fusion:11.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_fusion:11.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:15.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:15.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:15.0.2:*:*:*:*:*:*:*
https://www.vmware.com/security/advisories/VMSA-2019-0014.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Input validation error
EUVDB-ID: #VU21242
Risk: Low
CVSSv4.0: 1.1 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2019-5535
CWE-ID:
CWE-20 - Improper input validation
Exploit availability: No
DescriptionThe vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of IPV6 network traffic. A local user on guest OS can send specially crafted IPV6 packets and disallow network connectivity for all guest machines using VMware NAT mode.
Successful exploitation of this vulnerability requires that VMNAT is enabled.
MitigationInstall updates from vendor's website.
Vulnerable software versionsVMware Workstation: 15.0.0 - 15.1.0
VMware Fusion: 11.0.0 - 11.1.1
CPE2.3- cpe:2.3:a:vmware:vmware_workstation:15.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:15.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:15.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_fusion:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_fusion:11.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_fusion:11.0.2:*:*:*:*:*:*:*
https://www.vmware.com/security/advisories/VMSA-2019-0014.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Uncaught Exception
EUVDB-ID: #VU22319
Risk: Medium
CVSSv4.0: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2019-5536
CWE-ID:
CWE-248 - Uncaught Exception
Exploit availability: No
Description
The vulnerability allows a remote attacker to perform a denial of service (DoS) condition on the target system.
The vulnerability exists due to uncaught exception in the shader functionality. A remote authenticated attacker can send a specially crafted shader file and cause a denial of service condition on their own VM.
Note: Exploitation of this issue require an attacker to have access to a virtual machine with 3D graphics enabled.
MitigationInstall updates from vendor's website.
Vulnerable software versionsVMware ESXi: 6.5 - 6.7
VMware Workstation: 15.0.0 - 15.1.0
VMware Fusion: 11.0.0 - 11.1.1
CPE2.3- cpe:2.3:o:vmware:vmware_esxi:6.5:*:*:*:*:*:*:*
- cpe:2.3:o:vmware:vmware_esxi:6.7:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:15.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:15.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_workstation:15.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_fusion:11.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_fusion:11.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:vmware:vmware_fusion:11.0.2:*:*:*:*:*:*:*
https://www.talosintelligence.com/vulnerability_reports/TALOS-2019-0848
https://www.vmware.com/security/advisories/VMSA-2019-0019.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to open a a specially crafted file.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
