VMware Workstation 14.1.5 / VMware Player 15.0.2 - Host VMX Process Impersonation Hijack Privilege Escalation

VMware: Host VMX Process Impersonation Hijack EoP Platform: VMware Workstation Windows v14.1.5 on Windows 10. Also tested VMware Player 15.0.2. Class: Elevation of Privilege Summary: The creation of the VMX process on a Windows host can be hijacked leading to elevation of privilege. Description:...

VMware Workstation 14.1.5 / VMware Player 15 - Host VMX Process COM Class Hijack Privilege Escalation

VMware: Host VMX Process COM Class Hijack EoP Platform: VMware Workstation Windows v14.1.5 on Windows 10. Also tested VMware Player 15. Class: Elevation of Privilege Summary: COM classes used by the VMX process on a Windows host can be hijacked leading to elevation of privilege. Description: The...

VMware Workstation 14.1.5 / VMware Player 15 Host VMX Process COM Class Hijack Privilege Escalation

The VMX process vmware-vmx.exe process configures and hosts an instance of VM. As is common with desktop virtualization platforms the VM host usually has privileged access into the OS such as mapping physical memory which represents a security risk. To mitigate this the VMX process is created wit...

Firefox, Edge, Safari, Tesla & VMware pwned at Pwn2Own

By Waqas Pwn2Own 2019 has yet again proved that a secure system is nothing else but a myth. In its two days running, the contest has claimed many high-profile victims including the likes of Tesla, Firefox, and Safari. Pwn2Own is an annual hacking contest held in Vancouver alongside the CanSecWest...

Firefox and Edge Fall to Hackers on Day Two of Pwn2Own

Hackers took down the Mozilla Firefox and Microsoft Edge browsers on Thursday at Pwn2Own, the annual hacking conference held in tandem with CanSecWest, as the competition continued for a second day. The dynamic hacking duo of Amat Cama and Richard Zhu, which make up team Fluoroacetate, had anothe...

Hackers Take Down Safari, VMware and Oracle at Pwn2Own

Hackers took down Apple Safari, VMware Workstation, and Oracle VirtualBox on Wednesday, the first day of Pwn2Own, the annual hacking competition held in tandem with the CanSecWest conference in Vancouver. Contestants with the team of Fluoroacetate Amat Cama and Richard Zhu were the first to hit p...

VMware Workstation 14.x < 14.1.6 / 15.x < 15.0.3 Elevation of Privilege Vulnerability (VMSA-2019-0002)

The version of VMware Workstation installed on the remote host is 14.x prior to 14.1.6 or 15.x prior to 15.0.3. It is, therefore, affected by an elevation of privilege vulnerability in the creation of the VMX process on a windows host. An attacker with access to a host system may be able to hijac...

VMware Horizon View 6.x < 6.2.8 / 7.x (CR) < 7.8.0 / 7.5.x (ESB) < 7.5.2 Information Disclosure (VMSA-2019-0003)

The version of VMware Horizon View installed on the remote Windows host is 6.x prior to 6.2.8, 7.x CR prior to 7.8.0, or 7.5.x ESB prior to 7.5.2. It is, therefore, affected by an unspecified flaw in the 'Connection Server' that allows disclosure of sensitive information, including but not limite...

VMware Workstation Privilege Permission and Access Control Vulnerability (CNVD-2019-07558)

VMware Workstation is a set of virtual machine software from VMware. The software provides the ability to run multiple virtual machines with different operating systems at the same time. An elevation of privilege vulnerability exists in VMware Workstation versions 15.x and 14.x. An attacker could...

VMWare Horizon Information Disclosure Vulnerability

VMware Horizon is a suite of foundation platforms for virtual desktops and applications from VMware. It enables end users to access all of their virtual desktops, applications and online services through a digital workspace. An information disclosure vulnerability exists in VMWare Horizon version...

Vmware Workstation Privilege Permission and Access Control Vulnerability (CNVD-2019-07559)

VMware Workstation is a set of virtual machine software from VMware. The software provides the ability to run multiple virtual machines with different operating systems at the same time. An elevation of privilege vulnerability exists in Vmware Workstation versions 15.x and 14.x. An attacker could...

Photon OS 1.0: Elasticsearch PHSA-2019-1.0-0205

An update of the elasticsearch package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0205. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 1.0: Ruby PHSA-2019-1.0-0205

An update of the ruby package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0205. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid122903;...

Photon OS 1.0: Util PHSA-2019-1.0-0212

An update of the util package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0212. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid122926;...

Photon OS 1.0: Linux PHSA-2019-1.0-0211

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0211. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid122894...

Photon OS 1.0: Linux PHSA-2019-1.0-0205

An update of the linux package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0205. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid122901...

Photon OS 2.0: Kibana PHSA-2019-2.0-0132

An update of the kibana package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-2.0-0132. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid12290...

Photon OS 1.0: Kibana PHSA-2019-1.0-0205

An update of the kibana package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0205. The text itself is copyright C VMware, Inc. include'compat.inc'; if description scriptid12290...

Photon OS 1.0: Rsyslog PHSA-2019-1.0-0212

An update of the rsyslog package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0212. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 1.0: Nginx PHSA-2019-1.0-0211

An update of the nginx package has been released. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2019-1.0-0211. The text itself is copyright C VMware, Inc. include"compat.inc"; if description scriptid122895...