PT-2020-3042 · Vmware · Vmware Horizon Client+2

Published 2020-03-16 · Updated 2020-03-20 · CVE-2019-5543

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Horizon Client for Windows versions 5.x and prior before 5.3.0 VMware Remote Console for Windows versions 10.x before 11.0.0 VMware Workstation for Windows versions 15.x before 15.5.2

Description The issue is related to incorrect permission assignment for files in the VMware USB client service, affecting VMware Horizon Client, VMware Remote Console, and VMware Workstation for Windows operating systems. Exploitation of this issue may allow an attacker to execute arbitrary code. A local user on the system where the software is installed may exploit this issue to run commands as any user.

Recommendations For VMware Horizon Client for Windows versions 5.x and prior before 5.3.0, update to version 5.3.0 or later. For VMware Remote Console for Windows versions 10.x before 11.0.0, update to version 11.0.0 or later. For VMware Workstation for Windows versions 15.x before 15.5.2, update to version 15.5.2 or later.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

BDU:2020-03331

CVE-2019-5543

Affected Products

Vmware Horizon Client

Vmware Remote Console

Vmware Workstation

References · 5

• https://vmware.com/security/advisories/VMSA-2020-0004.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-5543 · Security Note
• https://osv.dev/vulnerability/CVE-2019-5543 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03331 · Security Note
• https://t.me/cvenotify/1768 · Telegram Post