Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.0278
AirWatch updates address bypass of root detection and local data encryption
31 January 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: AirWatch
Publisher: VMWare
Operating System: VMware ESX Server
Impact/Access: Root Compromise -- Existing Account
Access Privileged Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2017-4896 CVE-2017-4895
Original Bulletin:
http://www.vmware.com/security/advisories/VMSA-2017-0001.html
- --------------------------BEGIN INCLUDED TEXT--------------------
Advisory ID: VMSA-2017-0001
Severity: Important
Synopsis: AirWatch updates address bypass of root detection and local data
encryption
Issue date: 2017-01-30
Updated on: 2017-01-30 (Initial Advisory)
CVE numbers: CVE-2017-4895, CVE-2017-4896
1. Summary
AirWatch updates address bypass of root detection and local data encryption
2. Relevant Products
Airwatch Agent
Airwatch Console
AirWatch Inbox
3. Problem Description
a. Root detection bypass
Airwatch Agent for Android contains a vulnerability that may allow a
device to bypass root detection during enrollment. Successful exploitation
of this issue may result in an enrolled device having unrestricted access
over local Airwatch security controls and data.
VMware would like to thank Finn Steglich from SySS GmbH for reporting this
issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the identifier CVE-2017-4895 to this issue.
Column 5 of the following table lists the action required to remediate the
vulnerability in each release, if a solution is available.
VMware Product Running Severity Replace with/ Mitigation/
Product Version on Apply Patch Workaround
======= ======= ======= ========= ============= ===========
Airwatch x.x Android Important 7.0 None
Agent
b. Local data encryption bypass
Airwatch Inbox for Android contains a vulnerability that may allow a rooted
device to decrypt the local data used by the application. Successful
exploitation of this issue may result in an unauthorized disclosure of
confidential data.
VMware would like to thank Finn Steglich from SySS GmbH for reporting this
issue to us.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the identifier CVE-2017-4896 to this issue.
Column 5 of the following table lists the action required to remediate the
vulnerability in each release, if a solution is available.
VMware Product Running Severity Replace with/ Mitigation/
Product Version on Apply Patch Workaround
======= ======= ======= ========= ============= ===========
Airwatch x.x Android Important 9.0 FP1* KB115002293928
Console
Airwatch x.x Android Important 2.12* KB115002293928
Inbox
*To remediate this vulnerability, Pin-Based Encryption (PBE) must be
enabled. This feature was introduced in the versions of the Airwatch
Console and Inbox listed in the table above. PBE is also available
in many other Airwatch applications. For more information on PBE please
see: https://support.air-watch.com/articles/115002156907
4. Solution
Please review the patch/release notes for your product and version and
verify the checksum of your downloaded file.
Airwatch Agent for Android
Downloads and Documentation:
https://play.google.com/store/apps/details?id=com.airwatch.androidagent&hl=en
Airwatch Agent for Android
Downloads and Documentation:
https://play.google.com/store/apps/details?id=com.airwatch.email&hl=en
5. References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4895
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4896
https://support.air-watch.com/articles/115002293928
https://support.air-watch.com/articles/115002156907
6. Change log
2017-01-30: VMSA-2017-0001
Initial security advisory.
7. Contact
E-mail list for product security notifications and announcements:
http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce
This Security Advisory is posted to the following lists:
security-announce@lists.vmware.com
bugtraq@securityfocus.com
fulldisclosure@seclists.org
E-mail: security@vmware.com
PGP key at:
https://kb.vmware.com/kb/1055
VMware Security Advisories
http://www.vmware.com/security/advisories
VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html
VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html
Twitter
https://twitter.com/VMwareSRC
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWJArr4x+lLeg9Ub1AQgveA//ZCJYBbLIHzVnZGDZkYPsxu4Oieu3EO9b
KjN9cciM6U5zIJ3tnVmsZ44tvM3ByG/TUyIYyQAfTlegVCHS9wfotk4LrRdsBsMv
uHYChfSCZc8D9WFYF85aCKh0rbY+vkSaCW8THjMcmZZdMRF8kgA7aTwO7bfMMEOK
Wwa76hChMlnw7kef1VmB4Kus9ZH09K/xrMsZjVU7Xrmr0QfzDdG12rH6NsswVgWM
hiHnzmsS03ZVgOEPEriTPGJO9cyJXCKSGlzD26j8diYJdaNjQcu1ilQ/+3xGW6uG
f6rKtRSxgyPuwgIGcECWQZM+J5TJ3ufB7fw8YXoxtQatHU/B7xM1l0HrdfQcnWaE
HefOlLaXtJCv39kIFvGNW7D0U8UHMhG58yaG55A77pbhnCX6SphvWYO4i6+us0XN
1fNZVYY41tIwMtBnP+g+EQeeWnSwgxaCd9WJvFV2x9qxUw8H3x3BUv4aLog8vdk7
yR/V0qG9axlIN+69cbcsG2FOGp/ABSfvfu8+7Dt25Kjog3BZPs3iso++s4pneas4
0oAMP8CiixQ0qtWANOBlpClPn5aQbLHwOKk7ugFCLqcm/l1Bl2WgwzW3Mm3Toc9N
12sGUVcVU/HqnUBWzSg8Vf+wk1UwZqNGrXchDj1gqb23hQtTBB3xmqhXeswgJ+YN
Qvu96LgCjV4=
=JevC
-----END PGP SIGNATURE-----