CVE-2023-20867 is a low-severity vulnerability affecting VMware Tools, specifically versions from 10.3.0 up to 12.2.5. This vulnerability allows a fully compromised ESXi host to force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of the guest virtual machine. Systems running affected versions of VMware Tools, open-vm-tools, and related packages on various operating systems, such as Debian and Fedora, are at risk.

How do I know if I'm affected?

To determine if you're affected by the CVE-2023-20867 vulnerability, you should check if you're using VMware Tools versions from 10.3.0 up to 12.2.5. This vulnerability impacts the confidentiality and integrity of the guest virtual machine, as a fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations. Keep in mind that this issue affects various operating systems, including Debian and Fedora, but no specific Apple product versions have been mentioned in relation to this vulnerability.

What should I do if I'm affected by?

If you're affected by the CVE-2023-20867 vulnerability, it's important to update your VMware Tools to a secure version. For open-vm-tools, update to version 12.2.5 or later. Debian users should upgrade to version 2:10.3.10-1+deb10u4, and Fedora users should install the update using the command su -c 'dnf upgrade --advisory FEDORA-2023-20b6ac4b6c'. Always keep your software up-to-date to maintain security.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-20867 vulnerability, also known as the VMware Tools Authentication Bypass Vulnerability, is listed in CISA's Known Exploited Vulnerabilities Catalog. It was added to the catalog on June 23, 2023, and the due date for required action is July 14, 2023. To address this vulnerability, users should apply updates according to vendor instructions. In simple terms, this vulnerability could allow a compromised host system to bypass authentication, affecting the security and integrity of the guest virtual machine.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-287 involves improper authentication in VMware Tools, specifically the vgauth module.

For more details

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, refer to the National Vulnerability Database page or the resources listed below.

• NVD - CVE-2023-20867

• oss-security - Re: CVE-2023-20867: open-vm-tools: Authentication Bypass vulnerability in the vgauth module

• \[SECURITY\] \[DLA 3531-1\] open-vm-tools security update

• \[SECURITY\] Fedora 39 Update: open-vm-tools-12.3.0-1.fc39 - package-announce - Fedora Mailing-Lists