Critical VMware Zero-Day Bug Allows Command Injection; Patch Pending
upstart writes in with an IRC submission:
Critical VMware Zero-Day Bug Allows Command Injection; Patch Pending:
VMware explained it has no patch for a critical escalation-of-privileges bug that impacts both Windows and Linux operating systems and its Workspace One.
The U.S. Cybersecurity and Infrastructure Security Agency is warning of a zero-day bug affecting six VMware products including its Workspace One, Identity Manager and vRealize Suite Lifecycle Manager.
The critical unpatched bug is a command injection vulnerability.
In a separate VMware advisory, the company did not indicate whether the vulnerability was under active attack. Tracked as CVE-2020-4006, the bug has a CVSS severity rating of 9.1 out of 10. The company said patches are "forthcoming" and that workarounds "for a temporary solution to prevent exploitation of CVE-2020-4006" are available.
Read more of this story at SoylentNews.