VMware patched a security vulnerability related to vCenter Server last week. This security vulnerability numbered CVE-2020-3952 is located in VMware Directory Service (vmdir). The risk level of the Common Vulnerability Scoring System (CVSSv3) reaches a maximum of 10 points and it allows hackers to steal confidential information. vCenter Server is a central server used to manage the virtual architecture and it manages the VMware vSphere environment, simplifying and automating IT administrators’ control of the virtual environment. Vmdir is responsible for credential management, which can be used with vCenter Server and other VMware services.
The CVE-2020-3952 vulnerability is mainly caused by vmdir failing to implement access control correctly. VMware stated that hackers with network permissions to access vmdir deployments will be able to extract highly confidential information to compromise vCenter Server or other services that use vmdir for identity authentication. US-CERT also issued a warning against this vulnerability, claiming that the hacker who successfully exploited the vulnerability would be able to control the hacked system, and called on users to deploy the necessary updates as soon as possible.
In March, VMware fixed three high-hazard product vulnerabilities, including a serious vulnerability in Workstation and Fusion. An attacker can use the vulnerability from the guest operating system to execute arbitrary code on the host. The number of this serious vulnerability is CVE-2020-3947, which was caused by a bug in the wmnetdhcp component after the release. VMware stated in a security bulletin that the successful use of this issue by hackers led to code execution from the guest on the host, or caused an attacker to create a denial of service condition for the vmnetdhcp service running on the host machine.
Another vulnerability is the high-risk vulnerability CVE-2020-3948, which can cause local attackers with non-administrator access to Linux guests to elevate the permissions to root permissions in the same virtual machine through the installed VMware Tools. The last vulnerability is the high-risk privilege escalation vulnerability CVE-2019-5543, which affects the Windows version of Workstation, the Windows version of VMware Horizon client, and the Windows version of Remote Console (VMRC). This security vulnerability could cause a local attacker to run commands with arbitrary user rights. The reason for it is that the folder containing the configuration file of any VMware USB service can be written by all users.
LIFARS Gap Assessment Solution is designed to ascertain your comprehensive information security, risk and compliance status (current). Not only we determine your current state along with your risk appetite and tolerance, but we also provide you with an actionable roadmap to reach target maturity level including strategy, structure, governance, and operations management plan. Leveraging our extensive knowledge and experience, our competent Assessors and Project Managers focus on the following to deliver optimal services for you:
- Identify key business processes and associated information flow to ensure adequate threat modeling.
- Identify and engage key stakeholders to ensure adequate information discovery.
- Adhere to industry best practices and standards such as ISO, NIST, COBIT, and CIS.
- Provide Assessment Workbook prior to onsite and remote observations and interviews to maximize productivity.
- Optimally engage stakeholders for interviews and observations to minimize time impact.
- Provide Roadmap, Strategy and Operations Management plan aligned with your risk appetite and tolerance.
- Present findings to key stakeholders including executives to influence cultural changes.
Contact LIFARS Immediately For
Mitigating Cyber Risks in Your Organization
Credits:
https://www.cbronline.com/news/vmware-vulnerability-guardicore
