certfr_alerte - certfr-2020-ale-024

CERTFR-2020-ALE-024

Vulnerability from certfr_alerte

Une vulnérabilité a été découverte dans l'interface d'administration des produits Workspace One Access, Workspace One Access Connector, Identity Manager et Identity Manager Connector qui regroupent plusieurs fonctionnalités de sécurité centralisées : contrôleur d'accès à l'espace de travail, authentification sur les applications (SaaS, webs et mobiles).

La vulnérabilité nécessite d'avoir connaissance d'un mot de passe d'administrateur valide et d'avoir un accès réseau à cette interface. Néanmoins, son exploitation permettrait à un attaquant de prendre le contrôle du système et de pouvoir ainsi potentiellement se latéraliser sur d'autres équipements du système d'information avec des privilèges élevés.

Solution

[version du 07 décembre 2020] L'éditeur a publié le correctif pour l'ensemble des versions [3].

[version initiale] A l'heure de rédaction de cette alerte, l'éditeur n'a pas mis de correctif à disposition. Nous mettrons à jour cette alerte dès qu'un correctif sera annoncé.

Le CERT-FR recommande fortement :

d'appliquer sans délai le contournement publié par l'éditeur [2] tant que le correctif n'est pas déployé. Ce contournement permet de désactiver l'interface d'administration et de la réactiver uniquement lorsque cela est nécessaire.
de ne pas exposer cette interface d'administration (TCP/8443 par défaut) en dehors du réseau d'administration [1].

La mise à jour d’un produit ou d’un logiciel est une opération délicate qui doit être menée avec prudence. Il est notamment recommandé d’effectuer des tests autant que possible. Des dispositions doivent également être prises pour garantir la continuité de service en cas de difficultés lors de l’application des mises à jour comme des correctifs ou des changements de version.

None

Impacted products

Vendor	Product	Description
VMware	N/A	VMware vIDM Connector version 3.3.3 pour Windows
VMware	N/A	VMware vIDM version 3.3.2 pour Linux
VMware	N/A	VMware vIDM Connector version 3.3.1 pour Windows et Linux
VMware	N/A	VMware vIDM version 3.3.1 pour Linux
VMware	N/A	VMware vIDM Connector version 3.3.2 pour Windows et Linux
VMware	N/A	VMware Access version 20.10 pour Linux
VMware	N/A	VMware vIDM version 3.3.3 pour Linux
VMware	N/A	VMware Access version 20.01 pour Linux
VMware	Cloud Foundation	VMware Cloud Foundation (vIDM) version 4.x
VMware	N/A	vRealize Suite Lifecycle Manager (vIDM) version 8.x

References

Title

Publication Time

Tags

Bulletin de sécurité VMware VMSA-2020-0027 du 24 novembre 2020	None	vendor-advisory
avis CERT-FR CERTFR-2020-AVI-771 du 24 novembre 2020	-	other
[3] Correctif officiel publié par VMware	-	other
[1] Recommandations de l'ANSSI relatives à l’administration sécurisée des systèmes d’information	-	other
[2] Contournement officiel publié par VMware	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "VMware vIDM Connector version 3.3.3 pour Windows",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vIDM version 3.3.2 pour Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vIDM Connector version 3.3.1 pour Windows et Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vIDM version 3.3.1 pour Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vIDM Connector version 3.3.2 pour Windows et Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Access version 20.10 pour Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware vIDM version 3.3.3 pour Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Access version 20.01 pour Linux",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "VMware Cloud Foundation (vIDM) version 4.x",
      "product": {
        "name": "Cloud Foundation",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    },
    {
      "description": "vRealize Suite Lifecycle Manager (vIDM) version 8.x",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "VMware",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "closed_at": "2020-12-17",
  "content": "## Solution\n\n**\\[version du 07 d\u00e9cembre 2020\\]** L\u0027\u00e9diteur a publi\u00e9 le correctif pour\nl\u0027ensemble des versions **\\[3\\]**.\n\n**\\[version initiale\\]** A l\u0027heure de r\u00e9daction de cette alerte,\nl\u0027\u00e9diteur n\u0027a pas mis de correctif \u00e0 disposition. Nous mettrons \u00e0 jour\ncette alerte d\u00e8s qu\u0027un correctif sera annonc\u00e9.\n\nLe CERT-FR recommande fortement :\n\n-   d\u0027appliquer sans d\u00e9lai le contournement publi\u00e9 par l\u0027\u00e9diteur\n    **\\[2\\]** tant que le correctif n\u0027est pas d\u00e9ploy\u00e9. Ce contournement\n    permet de d\u00e9sactiver l\u0027interface d\u0027administration et de la r\u00e9activer\n    uniquement lorsque cela est n\u00e9cessaire.\n-   de ne pas exposer cette interface d\u0027administration (TCP/8443 par\n    d\u00e9faut) en dehors du r\u00e9seau d\u0027administration \\[1\\].\n\n\u00a0\n\n\u00a0\n\n------------------------------------------------------------------------\n\nLa mise \u00e0 jour d\u2019un produit ou d\u2019un logiciel est une op\u00e9ration d\u00e9licate\nqui doit \u00eatre men\u00e9e avec prudence. Il est notamment recommand\u00e9\nd\u2019effectuer des tests autant que possible. Des dispositions doivent\n\u00e9galement \u00eatre prises pour garantir la continuit\u00e9 de service en cas de\ndifficult\u00e9s lors de l\u2019application des mises \u00e0 jour comme des correctifs\nou des changements de version.\n",
  "cves": [
    {
      "name": "CVE-2020-4006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-4006"
    }
  ],
  "initial_release_date": "2020-11-24T00:00:00",
  "last_revision_date": "2020-12-17T00:00:00",
  "links": [
    {
      "title": "avis CERT-FR CERTFR-2020-AVI-771 du 24 novembre 2020",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2020-AVI-771/"
    },
    {
      "title": "[3] Correctif officiel publi\u00e9 par VMware",
      "url": "https://kb.vmware.com/s/article/81754"
    },
    {
      "title": "[1]\u00a0Recommandations de l\u0027ANSSI relatives \u00e0 l\u2019administration s\u00e9curis\u00e9e des syst\u00e8mes d\u2019information",
      "url": "https://www.ssi.gouv.fr/administration/guide/securiser-ladministration-des-systemes-dinformation/"
    },
    {
      "title": "[2] Contournement officiel publi\u00e9 par VMware",
      "url": "https://kb.vmware.com/s/article/81731"
    }
  ],
  "reference": "CERTFR-2020-ALE-024",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-11-24T00:00:00.000000"
    },
    {
      "description": "Publication du correctif par l\u0027\u00e9diteur",
      "revision_date": "2020-12-07T00:00:00.000000"
    },
    {
      "description": "Cl\u00f4ture de l\u0027alerte. Cela ne signifie pas la fin d\u0027une menace. Seule l\u0027application de la mise \u00e0 jour permet de vous pr\u00e9munir contre l\u0027exploitation de la vuln\u00e9rabilit\u00e9 correspondante.",
      "revision_date": "2020-12-17T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans l\u0027interface d\u0027administration des\nproduits Workspace One Access, Workspace One Access Connector, Identity\nManager et Identity Manager Connector qui regroupent plusieurs\nfonctionnalit\u00e9s de s\u00e9curit\u00e9 centralis\u00e9es : contr\u00f4leur d\u0027acc\u00e8s \u00e0 l\u0027espace\nde travail, authentification sur les applications (SaaS, webs et\nmobiles).\n\nLa vuln\u00e9rabilit\u00e9 n\u00e9cessite d\u0027avoir connaissance d\u0027un mot de passe\nd\u0027administrateur valide et d\u0027avoir un acc\u00e8s r\u00e9seau \u00e0 cette interface.\nN\u00e9anmoins, son exploitation permettrait \u00e0 un attaquant de prendre le\ncontr\u00f4le du syst\u00e8me et de pouvoir ainsi potentiellement se lat\u00e9raliser\nsur d\u0027autres \u00e9quipements du syst\u00e8me d\u0027information avec des privil\u00e8ges\n\u00e9lev\u00e9s.\n",
  "title": "[MaJ] Vuln\u00e9rabilit\u00e9 dans les produits VMware",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 VMware VMSA-2020-0027 du 24 novembre 2020",
      "url": "https://www.vmware.com/security/advisories/VMSA-2020-0027.html"
    }
  ]
}

CVE-2020-4006 (GCVE-0-2020-4006)

Vulnerability from cvelistv5

Published

2020-11-23 21:22

Modified

2025-10-21 23:35

Severity ?

9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE

Command Injection

Summary

VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability.

References

URL

Tags

https://www.vmware.com/security/advisories/VMSA-2020-0027.html

x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	VMware Workspace One Access (Access), VMware Workspace One Access Connector (Access Connector), VMware Identity Manager (vIDM), VMware Identity Manager Connector (vIDM Connector), VMware Cloud Foundation, vRealize Suite Lifecycle Manager	Version: Multiple

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T07:52:20.426Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://www.kb.cert.org/vuls/id/724367"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.vmware.com/security/advisories/VMSA-2020-0027.html"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2020-4006",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-04T15:35:26.673844Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2021-11-03",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4006"
              },
              "type": "kev"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-78",
                "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:35:32.373Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-4006"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2021-11-03T00:00:00+00:00",
            "value": "CVE-2020-4006 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "VMware Workspace One Access (Access), VMware Workspace One Access Connector (Access Connector), VMware Identity Manager (vIDM), VMware Identity Manager Connector (vIDM Connector), VMware Cloud Foundation, vRealize Suite Lifecycle Manager",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "Multiple"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-11-23T21:22:40.000Z",
        "orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
        "shortName": "vmware"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.vmware.com/security/advisories/VMSA-2020-0027.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security@vmware.com",
          "ID": "CVE-2020-4006",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "VMware Workspace One Access (Access), VMware Workspace One Access Connector (Access Connector), VMware Identity Manager (vIDM), VMware Identity Manager Connector (vIDM Connector), VMware Cloud Foundation, vRealize Suite Lifecycle Manager",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Multiple"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "VMware Workspace One Access, Access Connector, Identity Manager, and Identity Manager Connector address have a command injection vulnerability."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.vmware.com/security/advisories/VMSA-2020-0027.html",
              "refsource": "MISC",
              "url": "https://www.vmware.com/security/advisories/VMSA-2020-0027.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
    "assignerShortName": "vmware",
    "cveId": "CVE-2020-4006",
    "datePublished": "2020-11-23T21:22:40.000Z",
    "dateReserved": "2019-12-30T00:00:00.000Z",
    "dateUpdated": "2025-10-21T23:35:32.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2020-ALE-024

Vulnerability from certfr_alerte

Solution

CVE-2020-4006 (GCVE-0-2020-4006)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature