CVE-2020-3950 VMware Fusion Elevation of Privilege

Wed, 18 Mar 2020 03:55:16 +0000

VMware Fusion 11.5.12 and prior are vulnerable to an elevation of privilege vulnerability. For more details please review the advisory and proof of concept on my GitHub page CVE-2020-3950.sh. VMware released the patch last week and a public advisory VMSA-2020-0005 today however it has been determined that the patch does not properly fix the vulnerability. I reached out to the VMware security team and received a response at 10:31 UTC 2020-03-18 - “We are aware of the situation and working on the next steps”.

CVE-2019-6724 : Barracuda VPN Client Privilege Escalation on Linux and macOS

Thu, 14 Feb 2019 15:31:43 +0000

The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unprivileged local attacker to load a malicious library, resulting in arbitrary code executing as root.

This post will walk through the process on how I found and exploited the vulnerability on Linux. The full PoC will also work on macOS. When researching for potential vulnerabilities with privileged binaries a test system should be used to avoid causing damage or negative impacts.

macos on Rich Mirch

CVE-2020-3950 VMware Fusion Elevation of Privilege

CVE-2019-6724 : Barracuda VPN Client Privilege Escalation on Linux and macOS