2023-08-31 12:09:00
A vulnerability exists in VMware tools that allows attackers in a man-in-the-middle position between vCenter Server and the virtual machine to perform unauthorized access and actions. Updates are available to fix the vulnerability.
Advertisement
VMware Tools are designed to enable better management and seamless user interaction with guest operating systems. For example, they improve performance significantly and should therefore be installed by default by most users.
VMware Tools: Security token validation bypass
The vulnerability lies in a possible bypass of the verification of so-called SAML tokens. They transmit authentication information, for example. At a man-in-the-middle position between the vCenter Server and the virtual machine, malicious actors can bypass the SAML token validation and thereby perform operations in the guest using VMware Tools. They are potentially comprehensive, since the VMware tools provide drivers for graphics output, keyboard, mouse, drive and network access, for example. The developers therefore classify the vulnerability as a serious threat (CVE-2023-20900, CVSS 7.5Risk “hoch“).
VMware does not name temporary countermeasures. However, in the security advisory, they list the bug-fixed versions of VMware Tools. Version 12.3.0 corrects the error under Linux and Windows for the affected branches 10.3.x, 11.xx and 12.xx Under Linux there is also version 10.3.26 for older releases. The version with error correction depends on the version of the Linux distribution and the “distributor”.
On the current Download page for Windows as well as on the page for Linux you will find the software packages with the corrections. Only the 10.3.26 version is available there for Linux; newer packages usually come from the distribution as the open-vm-tools package.
Only on Wednesday of this week VMware had to close a critical security gap in VMware Aria Operations for Networks. It allows attackers to gain access without prior login.
Advertisement
(dmk)
To home page
1693486824
#VMware #Tools #Vulnerability #attackers #perform #unauthorized #actions #guests