-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2017.0278
AirWatch updates address bypass of root detection and local data encryption
                              31 January 2017

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           AirWatch
Publisher:         VMWare
Operating System:  VMware ESX Server
Impact/Access:     Root Compromise        -- Existing Account
                   Access Privileged Data -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2017-4896 CVE-2017-4895 

Original Bulletin: 
   http://www.vmware.com/security/advisories/VMSA-2017-0001.html

- --------------------------BEGIN INCLUDED TEXT--------------------

Advisory ID: VMSA-2017-0001
Severity:    Important
Synopsis:    AirWatch updates address bypass of root detection and local data 
             encryption
Issue date:  2017-01-30
Updated on:  2017-01-30 (Initial Advisory)
CVE numbers: CVE-2017-4895, CVE-2017-4896
 
1. Summary

    AirWatch updates address bypass of root detection and local data encryption

2. Relevant Products

    Airwatch Agent
    Airwatch Console
    AirWatch Inbox

3. Problem Description

    a. Root detection bypass
    Airwatch Agent for Android contains a vulnerability that may allow a 
    device to bypass root detection during enrollment. Successful exploitation
    of this issue may result in an enrolled device having unrestricted access 
    over local Airwatch security controls and data.
 
    VMware would like to thank Finn Steglich from SySS GmbH for reporting this
    issue to us.  

    The Common Vulnerabilities and Exposures project (cve.mitre.org) has 
    assigned the identifier CVE-2017-4895 to this issue.

    Column 5 of the following table lists the action required to remediate the
    vulnerability in each release, if a solution is available.

    VMware    Product  Running  Severity   Replace with/  Mitigation/ 
    Product   Version  on                  Apply Patch    Workaround
    =======   =======  =======  =========  =============  ===========
    Airwatch  x.x      Android  Important  7.0            None
    Agent 

    b. Local data encryption bypass

    Airwatch Inbox for Android contains a vulnerability that may allow a rooted
    device to decrypt the local data used by the application. Successful 
    exploitation of this issue may result in an unauthorized disclosure of 
    confidential data.

    VMware would like to thank Finn Steglich from SySS GmbH for reporting this 
    issue to us.

    The Common Vulnerabilities and Exposures project (cve.mitre.org) has 
    assigned the identifier CVE-2017-4896 to this issue.

    Column 5 of the following table lists the action required to remediate the
    vulnerability in each release, if a solution is available.

    VMware    Product  Running  Severity    Replace with/  Mitigation/ 
    Product   Version  on                   Apply Patch    Workaround
    =======   =======  =======  =========   =============  ===========
    Airwatch  x.x      Android  Important   9.0 FP1*       KB115002293928
    Console    
    
    Airwatch  x.x      Android  Important   2.12*          KB115002293928
    Inbox

    *To remediate this vulnerability, Pin-Based Encryption (PBE) must be 
    enabled. This feature was introduced in the versions of the Airwatch 
    Console and Inbox listed in the table above. PBE is also available 
    in many other Airwatch applications. For more information on PBE please 
    see: https://support.air-watch.com/articles/115002156907

4. Solution

    Please review the patch/release notes for your product and version and 
    verify the checksum of your downloaded file.

    Airwatch Agent for Android
    Downloads and Documentation:
    https://play.google.com/store/apps/details?id=com.airwatch.androidagent&hl=en

    Airwatch Agent for Android
    Downloads and Documentation:
    https://play.google.com/store/apps/details?id=com.airwatch.email&hl=en

5. References

    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4895
    http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-4896
    https://support.air-watch.com/articles/115002293928
    https://support.air-watch.com/articles/115002156907

6. Change log

    2017-01-30: VMSA-2017-0001
    Initial security advisory.

7. Contact

    E-mail list for product security notifications and announcements:
    http://lists.vmware.com/cgi-bin/mailman/listinfo/security-announce

    This Security Advisory is posted to the following lists:
    security-announce@lists.vmware.com
    bugtraq@securityfocus.com
    fulldisclosure@seclists.org

    E-mail: security@vmware.com
    PGP key at:
    https://kb.vmware.com/kb/1055

    VMware Security Advisories
    http://www.vmware.com/security/advisories

    VMware Security Response Policy
    https://www.vmware.com/support/policies/security_response.html

    VMware Lifecycle Support Phases
    https://www.vmware.com/support/policies/lifecycle.html

    Twitter
    https://twitter.com/VMwareSRC

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBWJArr4x+lLeg9Ub1AQgveA//ZCJYBbLIHzVnZGDZkYPsxu4Oieu3EO9b
KjN9cciM6U5zIJ3tnVmsZ44tvM3ByG/TUyIYyQAfTlegVCHS9wfotk4LrRdsBsMv
uHYChfSCZc8D9WFYF85aCKh0rbY+vkSaCW8THjMcmZZdMRF8kgA7aTwO7bfMMEOK
Wwa76hChMlnw7kef1VmB4Kus9ZH09K/xrMsZjVU7Xrmr0QfzDdG12rH6NsswVgWM
hiHnzmsS03ZVgOEPEriTPGJO9cyJXCKSGlzD26j8diYJdaNjQcu1ilQ/+3xGW6uG
f6rKtRSxgyPuwgIGcECWQZM+J5TJ3ufB7fw8YXoxtQatHU/B7xM1l0HrdfQcnWaE
HefOlLaXtJCv39kIFvGNW7D0U8UHMhG58yaG55A77pbhnCX6SphvWYO4i6+us0XN
1fNZVYY41tIwMtBnP+g+EQeeWnSwgxaCd9WJvFV2x9qxUw8H3x3BUv4aLog8vdk7
yR/V0qG9axlIN+69cbcsG2FOGp/ABSfvfu8+7Dt25Kjog3BZPs3iso++s4pneas4
0oAMP8CiixQ0qtWANOBlpClPn5aQbLHwOKk7ugFCLqcm/l1Bl2WgwzW3Mm3Toc9N
12sGUVcVU/HqnUBWzSg8Vf+wk1UwZqNGrXchDj1gqb23hQtTBB3xmqhXeswgJ+YN
Qvu96LgCjV4=
=JevC
-----END PGP SIGNATURE-----