VMware Workstation (15.x before 15.0.3, 14.x before 14.1.6) and Fusion (11.x before 11.0.3, 10.x before 10.1.6) updates address an out-of-bounds write vulnerability in the e1000 and e1000e virtual network adapters. Exploitation of this issue may lead to code execution on the host from the guest but it is more likely to result in a denial of service of the guest.

a. VMware ESXi, Workstation and Fusion UHCI out-of-bounds read/write and TOCTOU vulnerabilities

VMware ESXi, Workstation and Fusion contain an out-of-bounds read/write vulnerability and a Time-of-check Time-of-use (TOCTOU) vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface).
Exploitation of these issues requires an attacker to have access to a virtual machine with a virtual USB controller present. These issues may allow a guest to execute code on the host.

VMware would like to thank the Fluoroacetate team of Amat Cama and Richard Zhu, working with the Pwn2Own 2019 Security Contest, for reporting these issues to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifiers CVE-2019-5518 (out-of-bounds read/write) and CVE-2019-5519 (TOCTOU) to these issues.

b. VMware Workstation and Fusion out-of-bounds write vulnerability in e1000 virtual network adapter

VMware Workstation and Fusion contain an out-of-bounds write vulnerability in the e1000 virtual network adapter. This issue may allow a guest to execute code on the host.

VMware would like to thank security researcher Zhangyanyu of Chaitin Tech for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2019-5524 to this issue.

c. VMware Workstation and Fusion out-of-bounds write vulnerability in e1000 and e1000e virtual network adapters

VMware Workstation and Fusion updates address an out-of-bounds write vulnerability in the e1000 and e1000e virtual network adapters.
Exploitation of this issue may lead to code execution on the host from the guest but it is more likely to result in a denial of service of the guest.

VMware would like to thank ZhanluLab working with Trend Micro's Zero Day Initiative for reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2019-5515 to this issue.

d. VMware Fusion unauthenticated APIs Security vulnerability

VMware Fusion contains a security vulnerability due to certain unauthenticated APIs accessible through a web socket. An attacker may exploit this issue by tricking the host user to execute a JavaScript to perform unauthorized functions on the guest machine where VMware Tools is installed. This may further be exploited to execute commands on the guest machines.

VMware would like to thank CodeColorist (@CodeColorist) and Csaba Fitzl (@theevilbit) for independently reporting this issue to us.

The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the identifier CVE-2019-5514 to this issue.

The version of VMware Fusion installed on the remote macOS or Mac OS X host is 10.x prior to 10.1.6 or 11.x prior to 11.0.3. It is, therefore, affected by multiple vulnerabilities, including:

  - An out-of-bounds read/write vulnerability and a Time-of-check     Time-of-use (TOCTOU) vulnerability in the virtual USB 1.1 UHCI     (Universal Host Controller Interface). Exploitation of these     issues requires an attacker to have access to a virtual machine     with a virtual USB controller present. These issues may allow a     guest to execute code on the host. (CVE-2019-5518, CVE-2019-5519)

  - An out-of-bounds write vulnerability in the e1000 virtual network     adapter. This issue may allow a guest to execute code on the     host. (CVE-2019-5524)

  - An out-of-bounds write vulnerability in the e1000 and e1000e     virtual network adapters. Exploitation of this issue may lead to     code execution on the host from the guest but it is more likely     to result in a denial of service of the guest. (CVE-2019-5515)

  - A security vulnerability due to certain unauthenticated APIs     accessible through a web socket. An attacker may exploit this     issue by tricking the host user to execute a JavaScript to     perform unauthorized functions on the guest machine where VMware     Tools is installed. This may further be exploited to execute     commands on the guest machines. (CVE-2019-5514)

Note that CVE-2019-5524 only applies to VMware Fusion 10.x.

Note that CVE-2019-5514 only applies to VMware Fusion 11.x

The version of VMware Workstation installed on the remote host is 14.x prior to 14.1.4 or 15.x prior to 15.0.1. It is, therefore, affected by multiple vulnerabilities, including:

  - An out-of-bounds read/write vulnerability and a Time-of-check     Time-of-use (TOCTOU) vulnerability in the virtual USB 1.1 UHCI     (Universal Host Controller Interface). Exploitation of these     issues requires an attacker to have access to a virtual machine     with a virtual USB controller present. These issues may allow a     guest to execute code on the host. (CVE-2019-5518, CVE-2019-5519)

  - An out-of-bounds write vulnerability in the e1000 virtual network     adapter. This issue may allow a guest to execute code on the     host. (CVE-2019-5524)

  - An out-of-bounds write vulnerability in the e1000 and e1000e     virtual network adapters. Exploitation of this issue may lead to     code execution on the host from the guest but it is more likely     to result in a denial of service of the guest. (CVE-2019-5515)

Note that CVE-2019-5524 only applies to VMware Workstation 14.x and was fixed in 14.1.6.

Note that CVE-2019-5515 was fixed in 14.1.6 and 15.0.3.

ID	Name	Product	Family	Severity
123556	VMSA-2019-0005 : VMware ESXi, Workstation and Fusion updates address multiple security issues	Nessus	VMware ESX Local Security Checks	high
123517	VMware Fusion 10.x < 10.1.6 / 11.x < 11.0.3 Multiple Vulnerabilities (VMSA-2019-0005) (macOS)	Nessus	MacOS X Local Security Checks	high
123516	VMware Workstation 14.x < 14.1.7 / 15.x < 15.0.4 Multiple Vulnerabilities (VMSA-2019-0005)	Nessus	General	high

Detections

Analytics

CVE-2019-5515

high

Tenable Plugins

high

high

high