VMware Flaw a Vector in Solar Winds Breach?

Summary: U.S. government cybersecurity agencies warned that the attackers behind the SolarWinds compromise used weaknesses in non-SolarWinds products to reach high-value targets, including a VMware flaw (CVE-2020-4006) that the NSA said Russian state-sponsored actors exploited in VMware Access and Identity Manager to abuse federated authentication. VMware patched the flaw on Dec. 3 after learning of it from the NSA, and said it has received no indication that CVE-2020-4006 was used in conjunction with the SolarWinds supply chain compromise.
Why it matters: The NSA said exploiting the VMware flaw required access to a vulnerable device's management interface on the internal network - precisely the access the SolarWinds compromise provided - and CISA warned that where SAML signing certificates are abused, organizations should treat the entire identity trust store as compromised and consider a full rebuild of the environment.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2020-4006
Related: CVE-2020-4006: Multiple VMware Products Command Injection Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
Threat Brief: VMware Command Injection Vulnerability (CVE-2020-4006) Cyber Risks ·
Threat Advisory: NSA SVR Advisory Coverage Cyber Risks ·