VMware discloses a critical zero-day vulnerability (CVE-2020-4006) in multiple VMware Workspace One components and released a workaround to address it.
VMware has released a workaround to address a critical zero-day vulnerability, tracked as CVE-2020-4006, that affects multiple VMware Workspace One components. The flaw could be exploited by attackers to execute commands on the host Linux and Windows operating systems using escalated privileges.
VMware Workspace ONE allows to simply and securely deliver and manage any app on any device.
The zero-day flaw is a command injection issue that impacts the administrative configurator of some releases of VMware Workspace ONE Access, Access Connector, Identity Manager, and Identity Manager Connector.
“VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector contain a Command Injection Vulnerability in the administrative configurator. VMware has evaluated the this issue to be of Critical severity with a maximum CVSSv3 base score of 9.1.” reads the security advisory published by the virtualization giant.
Affected versions are:
- VMware Workspace One Access 20.10 (Linux)
- VMware Workspace One Access 20.01 (Linux)
- VMware Identity Manager 3.3.1 up to 3.3.3 (Linux)
- VMware Identity Manager Connector 3.3.2, 3.3.1 (Linux)
- VMware Identity Manager Connector 3.3.3, 3.3.2, 3.3.1 (Windows)
The Cybersecurity and Infrastructure Security Agency (CISA) also published a security advisory on the CVE-2020-4006 zero-day flaw.
“VMware has released workarounds to address a vulnerability—CVE-2020-4006—in VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector. An attacker could exploit this vulnerability to take control of an affected system.” reads the CISA’s advisory.
The company announced that patches for CVE-2020-4006 are forthcoming and recommends to implement ‘Workarounds’ for a temporary solution to prevent exploitation of CVE-2020-4006.
The workaround provided by the company only works with VMware Workspace One Access, VMware Identity Manager, and VMware Identity Manager Connector.
“Impacts are limited to functionality performed by this service. Configurator-managed setting changes will not be possible while the workaround is in place.”
“If changes are required please revert the workaround following the instructions below, make the required changes and disable again until patches are available. In addition, most of the system diagnostics dashboard will not be displayed.”
Details instructions on how to implement the workarounds on both Linux-based appliances and Windows-based servers are available at:
https://kb.vmware.com/s/article/81731
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, CVE-2020-4006)
[adrotate banner=”5″]
[adrotate banner=”13″]
