Potential Risk of CVE

Security Focus – CVE-2019-5513 VMware Horizon update addresses Connection Server information disclosure vulnerability: 14th Mar 2019

1 Comment

Preface: VMware Horizon Client for Android and iPhone makes it easy to work on your VMware Horizon virtual desktop and hosted applications from your smartphone.

About security advisory annoucement by VMware: The VMware Horizon Connection Server contains an information disclosure vulnerability. Successful exploitation of this issue may allow disclosure of internal domain names, the Connection Server’s internal name, or the gateway’s internal IP address.

My observation: Refer to route path 1,2,3 and 4 (refer to diagram). Because this application can run at Layer 4, transparency is enforced. Transparency takes a higher priority than Subnet Originating Requests. Therefore, if transparency is enabled on the Virtual Service and Subnet Originating Requests is enabled globally, the Virtual Service still uses transparency. The Real Server sees traffic from this virtual service originating with the client’s source IP address (transparency).

Reference: VMware announcement – 14th Mar 2019

https://www.vmware.com/security/advisories/VMSA-2019-0003.html

https://www.vmware.com/security/advisories/VMSA-2019-0002.html

One thought on “Security Focus – CVE-2019-5513 VMware Horizon update addresses Connection Server information disclosure vulnerability: 14th Mar 2019”

  1. This is my first time i visit here. I found so many entertaining stuff in your blog, especially its discussion. From the tons of comments on your articles, I guess I am not the only one having all the enjoyment here! Keep up the good work.

Comments are closed.