PT-2019-2593 · Vmware · Vmware Fusion+1

Codecolorist + 2 · Published 2019-03-28 · Updated 2021-07-21 · CVE-2019-5514

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Fusion versions 11.x before 11.0.3

Description The issue is related to insufficient input validation in the VMware Fusion hypervisor interface. This can be exploited by a remote attacker to execute arbitrary JavaScript code or run arbitrary commands using the VMware Tools utility set. The vulnerability involves certain unauthenticated APIs that are accessible through a web socket, which can be exploited by tricking the host user into executing JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines.

Recommendations For versions 11.x before 11.0.3, update to version 11.0.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the unauthenticated APIs accessible through the web socket to minimize the risk of exploitation. Additionally, avoid executing JavaScript code from untrusted sources on the host machine to prevent potential exploitation of the guest machine.

Fix

Missing Authentication

RCE

Weakness Enumeration

CWE-306

CWE-20

Related Identifiers

BDU:2019-02473

CVE-2019-5514

Affected Products

Vmware Fusion

Vmware Tools

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2019-5514 · Security Note
• https://vmware.com/security/advisories/VMSA-2019-0005.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-5514 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-02473 · Security Note
• http://securityfocus.com/bid/107637 · Note
• http://packetstormsecurity.com/files/152290/VMware-Security-Advisory-2019-0005.html · Note
• https://t.me/canyoupwnme/5488 · Telegram Post