Security News > 2022 > November > VMware warns of three critical holes in remote-control tool
VMware has revealed a terrible trio of critical-rated flaws in Workspace ONE Assist for Windows - a product used by IT and help desk staff to remotely take over and manage employees' devices.
A miscreant able to reach a Workspace ONE Assist deployment, either over the internet or on the network, can exploit any of these three bugs to obtain administrative access without the need to authenticate.
It's all possible because Workspace ONE Assist's authentication code appears to be - let's not sugar coat this - borked.
There's more! Workspace ONE Assist is also afflicted with a 6.4-rated cross-site scripting vulnerability that - thanks to improper user input sanitization - can be exploited, with some user interaction, to inject and run malicious JavaScript code in the victim's window.
These flaws apply to versions 21.x and 22.x of Workspace ONE Assist.
In happier news for Virtzilla, the company has announced that its cloudy wares are now available through HPE's GreenLake ITaaS platform, plus - irony alert - a "More secure" version of its Anywhere Workspace hybrid work suite.
News URL
Related news
- Critical Flaws in Tank Gauge Systems Expose Gas Stations to Remote Attacks (source)
- Critical Apache Avro SDK Flaw Allows Remote Code Execution in Java Applications (source)
- VMware Releases vCenter Server Update to Fix Critical RCE Vulnerability (source)
- VMware fixes critical vCenter Server RCE bug – again! (CVE-2024-38812) (source)
- VMware fixes bad patch for critical vCenter Server RCE flaw (source)
- VMware fixes critical RCE, make-me-root bugs in vCenter - for the second time (source)
- Week in review: Fortinet patches critical FortiManager 0-day, VMware fixes vCenter Server RCE (source)
- Critical RCE bug in VMware vCenter Server now exploited in attacks (source)
- Critical 9.8-rated VMware vCenter RCE bug exploited after patch fumble (source)