Geeks for your information
Security update for VMware Tools v12.3.0 for Windows, and v10.3.26 Linux (CVE-2023-20 - Printable Version

+- Geeks for your information (https://www.geeks.fyi)
+-- Forum: News (https://www.geeks.fyi/forumdisplay.php?fid=105)
+--- Forum: Privacy & Security News (https://www.geeks.fyi/forumdisplay.php?fid=107)
+--- Thread: Security update for VMware Tools v12.3.0 for Windows, and v10.3.26 Linux (CVE-2023-20 (/showthread.php?tid=19287)

Security update for VMware Tools v12.3.0 for Windows, and v10.3.26 Linux (CVE-2023-20 - harlan4096 - 07 September 23

Quote:Impacted Products​
  • VMware Tools
Quote:A SAML token signature bypass vulnerability in VMware Tools was responsibly reported to VMware. Updates are available to remediate this vulnerability in the affected VMware products.

 SAML Token Signature Bypass vulnerability (CVE-2023-20900)​
 
Quote:Description
VMware Tools contains a SAML token signature bypass vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.5.

Known Attack Vectors

A malicious actor with man-in-the-middle (MITM) network positioning in the virtual machine network may be able to bypass SAML token signature verification, to perform VMware Tools Guest Operations.

Release notes: https://docs.vmware.com/en/VMware-Tools/12.3/rn/vmware-tools-1230-release-notes/index.html
Quote:
  • Updated OpenSSL version to 3.0.8.
  • Updated libxml2 version to 2.10.4.
  • Updated glib version to 2.71.1.
  • Updated libffi version to 3.3.
  • This release resolves CVE-2023-20900.
  • From VMware Tools 12.3.0 version onwards, workload notifications for NSX distributed malware prevention is enabled.
  • VMware Tools 12.3.0 version provides support for Windows Arm VMs running on VMware Fusion on Apple silicon.
...
Source