PT-2020-3059 · Vmware · Vmware Fusion+2

Jeffball + 1 · Published 2020-05-29 · Updated 2021-09-08 · CVE-2020-3957

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions VMware Fusion versions 11.x before 11.5.5 VMware Remote Console for Mac versions 11.x and prior VMware Horizon Client for Mac versions 5.x and prior

Description The issue is related to insufficient access control in VMware products, allowing for local privilege escalation. Exploitation of this issue may enable an attacker to elevate their privileges to root level on the system. The vulnerability is due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener.

Recommendations For VMware Fusion versions 11.x before 11.5.5, update to version 11.5.5 or later. For VMware Remote Console for Mac versions 11.x and prior, update to a version later than 11.x. For VMware Horizon Client for Mac versions 5.x and prior, update to a version later than 5.x.

Fix

Time Of Check To Time Of Use

Improper Privilege Management

Weakness Enumeration

CWE-367

CWE-269

Related Identifiers

BDU:2020-03350

CVE-2020-3957

Affected Products

Vmware Fusion

Vmware Horizon Client For Mac

Vmware Remote Console For Mac

References · 6

• https://bdu.fstec.ru/vul/2020-03350 · Security Note
• https://vmware.com/security/advisories/VMSA-2020-0011.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-3957 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-3957 · Security Note
• ❌ https://github.com/Critical-Start/Team-Ares · Note, Deleted
• https://t.me/cybersecuritytechnologies/1376 · Telegram Post