Help Net Securitypublished Dec 7, 17:22 UTC (Dec 7, 2020)ingested Sep 10, 06:11 UTC@zeljkazorz

VMware releases workarounds for another critical flaw (CVE-2020-4006)

criticalVulnerability exploited in the wildimportance 60CVE-2020-4006

Read the original

Tagscve-2020-4006 vulnerability

Vulnerabilities mentionedAll →

CVE	Vulnerability	CVSS	EPSS	Flags	Affected	Exposure	Published
CVE-2020-4006	Command Injection in VMware Workspace ONE Access and Identity Manager CVE-2020-4006 is a command injection flaw (CWE-78, CVSS 3.1 9.1) in the admin consoles of VMware Workspace ONE Access, Workspace ONE Access Connector, VMware Identity Manager, and VMware Identity Manager Connector, with the affected components also shipped inside VMware Cloud Foundation and vRealize Suite Lifecycle Manager. An attacker who gains privileged access to an admin console, which is typically reachable over the network, can inject and run arbitrary commands on the appliance, achieving full compromise of the host with high confidentiality, integrity, and availability impact and a changed scope. Organizations running the affected identity products are exposed, especially where the admin console is internet-facing or reachable from untrusted networks. The bug was actively exploited by Russian state-sponsored (SVR/APT29) actors against unpatched deployments, prompting a CISA emergency directive, NSA and FBI joint warnings, and inclusion in the KEV catalog; EPSS estimates a 17.3% probability of exploitation within 30 days, and no public proof-of-concept is known. Do: Apply the patches VMware released in its November 2020 advisory (VMSA-2020-0027) for all affected products, connectors, and any Cloud Foundation or vRealize Suite Lifecycle Manager deployments that embed the components — this is a KEV-required action. As an interim mitigation, restrict network access to the admin console (typically port 8443) to trusted users and networks only. Review admin-console and system logs for signs of command injection or SVR/APT29 activity, since the bug was exploited in the wild by Russian state-sponsored actors.	9.1	17%	KEV	VMware Workspace ONE Access multiple affected releases (3.x/20.x lines) — see VMware security advisory VMware Workspace ONE Access Connector multiple affected releases (3.x/20.x lines) — see VMware security advisory VMware Identity Manager multiple affected releases (3.x/20.x lines) — see VMware security advisory +3 more	largetens of thousands of enterprise identity-appliance deployments, with likely several thousand admin consoles internet-exposed	Nov 23, 2020

CVE

Vulnerability

CVSS

EPSS

Flags

Affected

Exposure

Published

CVE-2020-4006

Command Injection in VMware Workspace ONE Access and Identity Manager

CVE-2020-4006 is a command injection flaw (CWE-78, CVSS 3.1 9.1) in the admin consoles of VMware Workspace ONE Access, Workspace ONE Access Connector, VMware Identity Manager, and VMware Identity Manager Connector, with the affected components also shipped inside VMware Cloud Foundation and vRealize Suite Lifecycle Manager. An attacker who gains privileged access to an admin console, which is typically reachable over the network, can inject and run arbitrary commands on the appliance, achieving full compromise of the host with high confidentiality, integrity, and availability impact and a changed scope. Organizations running the affected identity products are exposed, especially where the admin console is internet-facing or reachable from untrusted networks. The bug was actively exploited by Russian state-sponsored (SVR/APT29) actors against unpatched deployments, prompting a CISA emergency directive, NSA and FBI joint warnings, and inclusion in the KEV catalog; EPSS estimates a 17.3% probability of exploitation within 30 days, and no public proof-of-concept is known.

Do: Apply the patches VMware released in its November 2020 advisory (VMSA-2020-0027) for all affected products, connectors, and any Cloud Foundation or vRealize Suite Lifecycle Manager deployments that embed the components — this is a KEV-required action. As an interim mitigation, restrict network access to the admin console (typically port 8443) to trusted users and networks only. Review admin-console and system logs for signs of command injection or SVR/APT29 activity, since the bug was exploited in the wild by Russian state-sponsored actors.

9.1

17%

KEV

VMware Workspace ONE Access multiple affected releases (3.x/20.x lines) — see VMware security advisory
VMware Workspace ONE Access Connector multiple affected releases (3.x/20.x lines) — see VMware security advisory
VMware Identity Manager multiple affected releases (3.x/20.x lines) — see VMware security advisory
+3 more

largetens of thousands of enterprise identity-appliance deployments, with likely several thousand admin consoles internet-exposed

Nov 23, 2020

Full article407 words · extracted from helpnetsecurity.com · click to collapse

For the second time in less than a week, VMware is warning about a critical vulnerability (CVE-2020-4006). This time, the affected solutions are VMware Workspace One Access, Access Connector, VMware Identity Manager and VMware Identity Manager Connector.

As some of these are components of the VMware Cloud Foundation (vIDM) and vRealize Suite Lifecycle Manager (vIDM) product suites, those are impacted as well.

About the vulnerability (CVE-2020-4006)

Not much has been shared about CVE-2020-4006, except that it’s a command injection vulnerability that could allow a malicious actor with network access to the administrative configurator on port 8443 and a valid password for the configurator admin account to execute commands with unrestricted privileges on the underlying operating system.

The vulnerability was privately reported to VMware and the company categorized it as “critical.”

Affected products include:

VMware Workspace One Access v20.10 (Linux)
VMware Workspace One Access v20.01 (Linux)
VMware Identity Manager v3.3.3 (Linux)
VMware Identity Manager v3.3.2 (Linux)
VMware Identity Manager v3.3.1 (Linux)
VMware Identity Manager Connector v3.3.2 and 3.3.1 (Linux)
VMware Identity Manager Connector v3.3.3, 3.3.2, and 3.3.1 (Windows)
VMware Cloud Foundation (vIDM) v4.x (running on any platform)
vRealize Suite Lifecycle Manager (vIDM) v8.x (running on any platform)

VMware did not say whether the flaw is under active exploitation, but they released workarounds (and instructions on how to remove them) as they are working on the patches.

“This workaround is relevant for the configurator hosted on port 8443. Impacts are limited to functionality performed by this service. Configurator-managed setting changes will not be possible while the workaround is in place. If changes are required please revert the workaround following the instructions below, make the required changes and disable again until patches are available. In addition, most of the system diagnostics dashboard will not be displayed,” the company noted.

Last week, VMware patched critical flaws in its ESXi hypervisor that were exploited during the Tianfu Cup Pwn Contest that was held in Chengdu, China, earlier this month.

UPDATE (December 7, 2020, 9:10 a.m. PT):

VMware has re-classified CVE-2020-4006, lowering its severity. It is now deemed to be “important” (instead of “critical”) because “a malicious actor must posses valid credentials for the configurator admin account in order to attempt exploitation.”

That said, the NSA warns that Russian state-sponsored malicious cyber actors are actively exploiting it.

Security fixes have been released for all affected solutions, including one that has been added to the list recently – vIDM Connector for Windows (19.03.0.0, 19.03.0.1).

Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2020/11/24/vmware-releases-workarounds-for-another-critical-flaw-cve-2020-4006/