{"id":446,"date":"2018-01-05T13:34:16","date_gmt":"2018-01-05T13:34:16","guid":{"rendered":"http:\/\/michaelstoica.com\/?p=446"},"modified":"2018-01-05T13:34:16","modified_gmt":"2018-01-05T13:34:16","slug":"vmware-vmsa-2018-0002-vmsa-2018-0003","status":"publish","type":"post","link":"https:\/\/michaelstoica.com\/site\/vmware-vmsa-2018-0002-vmsa-2018-0003\/","title":{"rendered":"VMware VMSA-2018-0002 &#038; VMSA-2018-0003"},"content":{"rendered":"<p>Google Prohect Zero released these days information about two vulnerabilities found on all major CPUs vendors: <strong>Meltdown &#8211; CVE-2017-5754<\/strong>\u00a0 rogue data cache load and <strong>Spectre &#8211; CVE-2017-5753 &amp; CVE2017-5715<\/strong> bounds check bypass and branch target injection. You can read more about these here: https:\/\/googleprojectzero.blogspot.ro\/2018\/01\/reading-privileged-memory-with-side.html and\u00a0https:\/\/thehackernews.com\/2018\/01\/meltdown-spectre-vulnerability.html<\/p>\n<p>VMware released yesterday and today two security advisors that address this issue:\u00a0<strong>VMSA-2018-0002<\/strong> VMware ESXi, Workstation and Fusion updates address side-channel analysis due to speculative execution and\u00a0<strong>VMSA-2018-0003<\/strong> vRealize Operations for Horizon, vRealize Operations for Published Applications, Workstation, Horizon View Client and Tools updates resolve multiple security vulnerabilities.<\/p>\n<p>The VMSA-2018-002 address the following issue &#8220;CPU data cache timing can be abused to efficiently leak information out of mis-speculated CPU execution, leading to (at worst) arbitrary virtual memory read vulnerabilities across local security boundaries in various contexts. (Speculative execution is an automatic and inherent CPU performance optimization used in all modern processors.) ESXi, Workstation and Fusion are vulnerable to Bounds Check Bypass and Branch Target Injection issues resulting from this vulnerability.&#8221;<\/p>\n<p>Products that are affected:<\/p>\n<ul>\n<li>VMware vSphere ESXi from version 5.5 to 6.5<\/li>\n<li>VMware Workstation 12.x and 14.x<\/li>\n<li>VMware Fusion 8.x and 10.x<\/li>\n<\/ul>\n<p>The VMSA-2018-003 refers to the following issue &#8220;V4H and V4PA desktop agent privilege escalation vulnerability. The V4H and V4PA desktop agents contain a privilege escalation vulnerability. Successful exploitation of this issue could result in a low privileged windows user escalating their privileges to SYSTEM.&#8221;<\/p>\n<p>Products that are affected:<\/p>\n<ul>\n<li>vRealize\u00a0Operations for Horizon<\/li>\n<li>vRealize Operations for Published Applications<\/li>\n<li>VMware Workstation<\/li>\n<li>VMware Fusion<\/li>\n<li>Horizon View Client for windows<\/li>\n<\/ul>\n<p>You can read more here:\u00a0https:\/\/www.vmware.com\/security\/advisories\/VMSA-2018-0002.html &amp;\u00a0https:\/\/www.vmware.com\/security\/advisories\/VMSA-2018-0003.html<\/p>\n<p>And don&#8217;t forget, sing up for Security Advisories so that you aware of patches faster.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Google Prohect Zero released these days information about two vulnerabilities found on all major CPUs vendors: Meltdown &#8211; CVE-2017-5754\u00a0 rogue data cache load and Spectre&#8230;<\/p>\n<div class=\"more-link-wrapper\"><a class=\"more-link\" href=\"https:\/\/michaelstoica.com\/site\/vmware-vmsa-2018-0002-vmsa-2018-0003\/\">Continue reading<span class=\"screen-reader-text\">VMware VMSA-2018-0002 &#038; VMSA-2018-0003<\/span><\/a><\/div>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[1],"tags":[31,13,12],"class_list":["post-446","post","type-post","status-publish","format-standard","hentry","category-general","tag-esxi","tag-vmware","tag-vsphere","entry"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p63Lge-7c","_links":{"self":[{"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/posts\/446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/comments?post=446"}],"version-history":[{"count":2,"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/posts\/446\/revisions"}],"predecessor-version":[{"id":448,"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/posts\/446\/revisions\/448"}],"wp:attachment":[{"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/media?parent=446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/categories?post=446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/michaelstoica.com\/site\/wp-json\/wp\/v2\/tags?post=446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}