VMSA-2019-0021

Advisory ID	VMSA-2019-0021
Advisory Severity	Important
CVSSv3 Range	5.0-8.7
Synopsis	VMware Workstation and Fusion updates address multiple security vulnerabilities (CVE-2019-5540, CVE-2019-5541, CVE-2019-5542)
Issue Date	2019-11-12
Updated On	2019-11-12 (Initial Advisory)
CVE(s)	CVE-2019-5540, CVE-2019-5541, CVE-2019-5542

1. Impacted Products

VMware Workstation Pro / Player (Workstation)
VMware Fusion Pro / Fusion (Fusion)

2. Introduction

VMware Workstation and Fusion contain multiple security vulnerabilities. Patches and workarounds are available to remediate these vulnerabilities in affected VMware products.

3a. VMware Workstation and Fusion out-of-bounds write vulnerability in e1000e virtual network adapter (CVE-2019-5541)

Description:

VMware Workstation and Fusion contain an out-of-bounds write vulnerability in the e1000e virtual network adapter. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 8.7.

Known Attack Vectors:

Successful exploitation of this issue may lead to code execution on the host from the guest or may allow attackers to create a denial-of-service condition on their own VM.

Resolution:

To remediate CVE-2019-5541, apply the patches listed in the 'Fixed Version' column of the 'Resolution Matrix' found below.

Workarounds:

None.

Additional Documentations:

None.

Acknowledgements:

VMware would like to thank instructor working with Trend Micro's Zero Day Initiative for reporting this issue to us.

Resolution Matrix:

Product	Version	Running On	CVE Identifier	CVSSV3	Severity	Fixed Version	Workarounds	Additional Documents
Workstation	15.x	Any	CVE-2019-5541	8.7	Important	15.5.1	None	None
Fusion	11.x	OSX	CVE-2019-5541	8.7	Important	11.5.1	None	None

3b. VMware Workstation and Fusion vmnetdhcp information disclosure vulnerability (CVE-2019-5540)

Description:

Workstation and Fusion contain an information disclosure vulnerability in vmnetdhcp. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.7.

Known Attack Vectors:

Successful exploitation of this issue may allow an attacker on a guest VM to disclose sensitive information by leaking memory from the host process.

Resolution:

To remediate CVE-2019-5540, apply the patches listed in the 'Fixed Version' column of the 'Resolution Matrix' found below.

Workarounds:

None.

Additional Documentations:

None.

Acknowledgements:

VMware would like to thank S4nnyb0y for reporting this issue to us.

Resolution Matrix:

Product	Version	Running On	CVE Identifier	CVSSV3	Severity	Fixed Version	Workarounds	Additional Documents
Workstation	15.x	Any	CVE-2019-5540	7.7	Important	15.5.1	None	None
Fusion	11.x	OSX	CVE-2019-5540	7.7	Important	11.5.1	None	None

3c. VMware Workstation and Fusion denial-of-service vulnerability (CVE-2019-5542)

Description:

VMware Workstation and Fusion contain a denial-of-service vulnerability in the RPC handler. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.0.

Known Attack Vectors:

Successful exploitation of this issue may allow attackers with normal user privileges to create a denial-of-service condition on their own VM.

Resolution:

To remediate CVE-2019-5542, apply the patches listed in the 'Fixed Version' column of the 'Resolution Matrix' found below.

Workarounds:

None.

Additional Documentations:

None.

Acknowledgements:

VMware would like to thank Jinwei Chen of Bangcle Security for reporting this issue to us.

Resolution Matrix:

Product	Version	Running On	CVE Identifier	CVSSV3	Severity	Fixed Version	Workarounds	Additional Documents
Workstation	15.x	Any	CVE-2019-5542	5.0	Moderate	15.5.1	None	None
Fusion	11.x	OSX	CVE-2019-5542	5.0	Moderate	11.5.1	None	None