CVE-2020-3941

CVE-2020-3941 boils down to a race-condition in the repair operation of VMware Tools for Windows (10.x.y), which may enable local privilege escalation in the guest VM. VMware notes the vulnerability is not present in Tools 11.x.y, where the affected functionality is removed. Affected remediation ...

Policy Compliance Library Updates, January 2020

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from OS an...

CVE-2020-3941

The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine where Tools is installed. This vulnerability is not present in VMware Tools 11.x.y since the affected functionality is not present in VMware Tools 11. Recen...

VMware Releases Security Update

VMware has released a security update to address a vulnerability in VMware Tools. An attacker could exploit this vulnerability to take control of an affected system. The Cybersecurity and Infrastructure Security Agency CISA encourages users and administrators to review VMware Security Advisory...

VMware Harbor 1.7.x, 1.8.x < 1.8.6 / 1.9.x < 1.9.3

The version of VMware Harbor installed on the remote host is 1.7.x or 1.8.x prior to 1.8.6 or 1.9.x prior to 1.9.3. It is, therefore, affected multiple vulnerabilities, including the following: - A privilege escalation vulnerability that allows an authenticated, normal user to gain administrative...

A vulnerability exists in the properties of the vAppConfig component of the VMware vCenter Server management tool, which allows an attacker to access user credentials.

The vulnerability in the vAppConfig properties of the VMware vCenter Server management tool is related to insufficient protection for registration data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to user registration data...

How to Use VMware Carbon Black’s Real-Time Endpoint Query to Identify BlueKeep Vulnerability Risk

Recently, security researchers revealed a Proof of Concept attack that leverages the BlueKeep vulnerability. Whenever this type of news breaks on the twittersphere, organizations are left with the question: "Are we susceptible to this type of attack?" Using CB LiveOps, a real-time endpoint query...

VMware Horizon View Agent 7.x < 7.5.4 / 7.10.1 / 7.11.0 Privilege Escalation (VMSA-2019-0023)

The VMware Horizon View Agent installed on the remote host is 7.x prior to 7.5.4, 7.10.1, or 7.11.0. It is, therefore, affected by a DLL hijacking vulnerability due to insecure loading of a DLL by Cortado Thinprint. An authenticated, local attacker with normal user privileges can exploit this to...

VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability (CVE-2020-3940)

3. VMware Workspace ONE SDK and dependent mobile application updates address sensitive information disclosure vulnerability CVE-2020-3940 VMware Workspace ONE SDK and dependent mobile applications do not properly handle certificate verification failures if SSL Pinning has been enabled in the...

Photon OS 1.0: Gc PHSA-2019-1.0-0260

An update of the gc package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0260. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid132694;...

VMSA-2020-0002:VMware Tools workaround addresses a local privilege escalation vulnerability

Advisory ID: VMSA-2020-0002 CVSSv3 Range: 7.8 Issue Date:2020-01-14 Updated On: 2020-01-14 Initial Advisory CVEs: CVE-2020-3941 Synopsis: VMware Tools workaround addresses a local privilege escalation vulnerability CVE-2020-3941 RSS Feed Download PDF Download Text File Share this page on social...

Photon OS 2.0: Docker PHSA-2019-2.0-0193

An update of the docker package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0193. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid13267...

Photon OS 3.0: Haproxy PHSA-2019-3.0-0038

An update of the haproxy package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-3.0-0038. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

EulerOS 2.0 SP8 : openslp (EulerOS-SA-2020-1038)

According to the version of the openslp packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the...

Photon OS 2.0: Python3 PHSA-2019-2.0-0187

An update of the python3 package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0187. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 3.0: Libarchive PHSA-2019-3.0-0041

An update of the libarchive package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-3.0-0041. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 1.0: Postgresql PHSA-2019-1.0-0257

An update of the postgresql package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0257. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 2.0: Libpcap PHSA-2019-2.0-0187

An update of the libpcap package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0187. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 3.0: Linux PHSA-2019-3.0-0041

An update of the linux package has been released. C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-3.0-0041. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid132530;...

NewStart CGSL CORE 5.04 / MAIN 5.04 : openslp Vulnerability (NS-SA-2019-0260)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has openslp packages installed that are affected by a vulnerability: - OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical...