VMware has released security patches for the use-after-free vulnerability in vmnetdhcp, local Privilege escalation vulnerability in Cortado Thinprint, and VMware Horizon Client, VMRC and Workstation privilege escalation vulnerability.
Three serious bugs
The first bug tracked as CVE-2020-3947 has affected VMware Workstation (15.x prior to 15.5.2) and Fusion (11.x prior to 11.5.2). It was defined as a use-after vulnerability in vmnetdhcp. Hackers can exploit VMware Workstation and Fusion to gain code execution on the host from the guest. In addition to this, attackers can also create a denial-of-service condition of the vmnetdhcp service running on the host machine.
VMware explained the bug,
“Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition of the vmnetdhcp service running on the host machine.”
The second bug in VMware’s desktop-class virtualization products, tracked CVE-2020-3948 is a local privilege escalation vulnerability in Cortado Thinprint.
The third bug assigned as CVE-2019-5543 has the Important severity range with a maximum CVSSv3 base score of 7.3. It is a privilege escalation vulnerability in VMware Horizon Client, VMRC, and Workstation. According to VMware, the folder containing configuration files for the VMware USB arbitration service was found to be writable by all users.Stay tuned for up-to-date Cloud Computing News