Close
  • Latest News
  • Cybersecurity
  • Big Data and Analytics
  • Cloud
  • Mobile
  • Networking
  • Storage
  • Applications
  • IT Management
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
Read Down
Sign in
Close
Welcome!Log into your account
Forgot your password?
Read Down
Password recovery
Recover your password
Close
Search
Menu
Search
  • Latest News
  • Cybersecurity
  • Big Data and Analytics
  • Cloud
  • Mobile
  • Networking
  • Storage
  • Applications
  • IT Management
  • Small Business
  • Development
  • Database
  • Servers
  • Android
  • Apple
  • Innovation
  • Blogs
  • PC Hardware
  • Reviews
  • Search Engines
  • Virtualization
More
    Home Cybersecurity
    • Cybersecurity

    VMware Patches Security Vulnerabilities First Disclosed at Pwn2Own

    By
    Sean Michael Kerner
    -
    March 31, 2017
    Share
    Facebook
    Twitter
    Linkedin
      Pwn2own 2017

      VMware customers now have patches for four different security vulnerabilities that were first demonstrated at the Pwn2Own hacking competition on March 17. Two separate groups of security research teams were able to successfully exploit VMware products at the Pwn2own event that awards security researchers for demonstrating zero-day vulnerabilities in software.

      Team 360 Security researchers from Qihoo 360 Software, were able to successfully exploit VMware Workstation at the Pwn2Own event with a chain of several exploits. For their efforts, Trend Micro’s Zero Day Initiative (ZDI), which runs the Pwn2Own event, awarded the researchers $105,000. At the event, ZDI reported that 360 Security was able to chain together a memory heap overflow vulnerability in Microsoft’s Edge web browser, accompanied by a type confusion vulnerability in the Microsoft Windows kernel.  The final link in the exploit chain was initially reported as a zero-day uninitialized buffer vulnerability in VMware Workstation. The entire exploit enabled the researchers to successfully execute a virtual machine escape.

      VMware’s security advisory on the issue identifies the flaw as an SVGA memory corruption vulnerability combined with a heap buffer overflow. The two vulnerabilities are officially designated as CVE-2017-4902 (heap issue) and CVE-2017-4903 (stack issue).

      “ESXi, Workstation and Fusion have a heap buffer overflow and uninitialized stack memory usage in SVGA,” VMware’s advisory states. “These issues may allow a guest to execute code on the host.”

      The second group that successfully exploited VMware at Pwn2Own was Tencent Security Team Sniper, which also made use of an exploit chain. ZDI awarded Team Sniper $100,000 for demonstrating a VMware Workstation attack that enabled the Team Sniper researchers to escape from the guest virtual machine to attack the host system.

      “The ESXi, Workstation, and Fusion XHCI controller has uninitialized memory usage,” VMware’s advisory warns.  “This issue may allow a guest to execute code on the host.”

      The second issue (CVE-2017-4905) reported by Team Sniper and now fixed by VMware, is also identified as an uninitialized memory usage vulnerability. Though as opposed to the first issue, the CVE-2017-4905 flaw can lead to information disclosure.

      VMware is not the only vendor that has already publicly patched flaws that were first demonstrated at the Pwn2Own 2017 event. Linux kernel developers have also patched for an exploit identified as CVE-2017-7184 that was first publicly demonstrated on the first day of the Pwn2own event.

      Mozilla was actually the first software vendor to publicly patch for flaws revealed at the 2017 Pwn2Own event. The Mozilla Firefox web browser was exploited on March 16, during the second day of the event. Researchers from Chaitin Security Research Lab earned $30,000 for demonstrating an integer overflow exploit identified as CVE-2017-5248. Mozilla patched the flaw within a day of the researchers demonstrating the flaw, releasing a patched version of Firefox on March 17.

      Avatar
      Sean Michael Kerner
      Sean Michael Kerner is an Internet consultant, strategist, and contributor to several leading IT business web sites.

      MOST POPULAR ARTICLES

      Android

      Samsung Galaxy XCover Pro: Durability for Tough...

      Chris Preimesberger - December 5, 2020 0
      Have you ever dropped your phone, winced and felt the pain as it hit the sidewalk? Either the screen splintered like a windshield being...
      Read more
      Cloud

      Why Data Security Will Face Even Harsher...

      Chris Preimesberger - December 1, 2020 0
      Who would know more about details of the hacking process than an actual former career hacker? And who wants to understand all they can...
      Read more
      Cybersecurity

      How Veritas Is Shining a Light Into...

      eWEEK EDITORS - September 25, 2020 0
      Protecting data has always been one of the most important tasks in all of IT, yet as more companies become data companies at the...
      Read more
      Big Data and Analytics

      How NVIDIA A100 Station Brings Data Center...

      Zeus Kerravala - November 18, 2020 0
      There’s little debate that graphics processor unit manufacturer NVIDIA is the de facto standard when it comes to providing silicon to power machine learning...
      Read more
      Apple

      Why iPhone 12 Pro Makes Sense for...

      Wayne Rash - November 26, 2020 0
      If you’ve been watching the Apple commercials for the past three weeks, you already know what the company thinks will happen if you buy...
      Read more
      eWeek


      Contact Us | About | Sitemap

      Facebook
      Linkedin
      RSS
      Twitter
      Youtube

      Property of TechnologyAdvice.
      Terms of Service | Privacy Notice | Advertise | California - Do Not Sell My Information

      © 2021 TechnologyAdvice. All Rights Reserved

      Advertiser Disclosure: Some of the products that appear on this site are from companies from which TechnologyAdvice receives compensation. This compensation may impact how and where products appear on this site including, for example, the order in which they appear. TechnologyAdvice does not include all companies or all types of products available in the marketplace.

      ×