|Number of vulnerabilities||1|
|Exploitation vector||Local network|
Operating systems & Components / Operating system
open-vm-tools (Ubuntu package)
Operating systems & Components / Operating system package or component
This security bulletin contains one medium risk vulnerability.
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to improper verification of SAML token signature. A remote attacker can bypass SAML token signature verification and perform man-in-the-middle (MITM) network positioning between vCenter server and the virtual machine.Mitigation
Update the affected package open-vm-tools to the latest version.Vulnerable software versions
Ubuntu: 16.04 - 18.04
open-vm-tools (Ubuntu package): before Ubuntu ProFixed software versions
Q & A
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?