VMware fixed vulnerabilities attackers could link to take complete control of vRealize Automation (vRA) appliances.
One of the flaws can end up exploited by an attacker with access to a low-privileged account to escalate their permissions to root. The flaw, that has a case number of CVE-2016-5335, affects vRA 7.0.x and VMware Identity Manager 2.x.
RELATED STORIES
VMware Fixes Vulnerabilities
VMware Fixes Critical Flaws
Updated Ransomware Releases
Locky Top Malware Threat for Q2
The second vulnerability, CVE-2016-5336, can end up leveraged for remote code execution, allowing an attacker to gain access to a low-privileged account on the affected vRA 7.0.x appliance via port 40002.
VMware decided rated this issue “important” due to the fact an attacker can only access a service account with minimal privileges.
However, while taken separately these vulnerabilities are not critical, VMware said an attacker could combine them and completely compromise a vRA appliance — use CVE-2016-5336 to gain access to a low-privileged account and CVE-2016-5335 to escalate their privileges on that account.
The flaws ended up patched in VMware Identity Manager version 2.7 and vRA version 7.1. As a workaround, customers can prevent attacks involving CVE-2016-5336 by creating specific firewall rules in the vRA appliance.
Users have been advised to update vRA to version 7.1 as soon as possible or apply the workaround.
VMware also updated an older advisory describing a critical deserialization vulnerability to clarify that vRealize Operations appliances prior to version 6.2 are also affected.
Earlier this month, researchers detailed a VMware Tools vulnerability that can end up exploited to hijack a DLL and execute arbitrary code on the targeted system.