CVE-2018-6968 : Security Advisory and Response

A security flaw has been identified in the VMware AirWatch Agent for Android versions earlier than 8.2 and AirWatch Agent for Windows Mobile versions earlier than 6.5.2. This vulnerability affects the real-time File Manager capabilities, potentially enabling unauthorized access to create and run files in publicly accessible directories.

Understanding CVE-2018-6968

This CVE involves a remote code execution vulnerability in the VMware AirWatch Agent for Android and Windows Mobile.

What is CVE-2018-6968?

The vulnerability allows a malicious administrator to create and execute files in the Agent sandbox and other accessible directories, compromising system integrity.

The Impact of CVE-2018-6968

Exploiting this flaw could lead to unauthorized access and manipulation of files, posing a significant security risk to affected systems.

Technical Details of CVE-2018-6968

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The VMware AirWatch Agent for Android and Windows Mobile versions prior to 8.2 and 6.5.2, respectively, contain a remote code execution vulnerability in the real-time File Manager capabilities.

Affected Systems and Versions

Product: AirWatch Agent
Vendor: VMware
Affected Versions:
AirWatch Agent for Android prior to 8.2
AirWatch Agent for Windows Mobile prior to 6.5.2

Exploitation Mechanism

The vulnerability allows unauthorized administrators to create and execute files in the Agent sandbox and publicly accessible directories, such as those on the SD card.

Mitigation and Prevention

Protecting systems from CVE-2018-6968 requires immediate action and long-term security practices.

Immediate Steps to Take

Update AirWatch Agent for Android to version 8.2 or later.
Update AirWatch Agent for Windows Mobile to version 6.5.2 or later.
Monitor system activities for any suspicious file creation or execution.

Long-Term Security Practices

Implement access controls to restrict unauthorized file operations.
Conduct regular security audits and vulnerability assessments.
Educate users on safe file handling practices.

Patching and Updates

Regularly check for security updates and patches from VMware.
Apply patches promptly to mitigate the risk of exploitation.