Pair of VMWare Vulnerabilities Could Lead to Code Execution
Cisco Talos discovered a pair of vulnerabilities in the VNC implementation for VMWare products that, if exploited, could allow a threat actor to execute code. VNC is implemented for remote management and access, and automation for VMWare Workstation, Player, and ESXi. A threat actor could initiate a VNC session – which does not require a username and password by default – and craft a set of VNC packets to trigger the vulnerabilities. The NJCCIC recommends VMWare users and administrators review the Talos advisories for CVE-2017-4933 and CVE-2017-4941 and immediately turn on VNC authentication to mitigate these vulnerabilities.