VMware’s warned that the agent used by its AirWatch mobile device management product has a vulnerability that could allow remote control of mobile devices running Android or Windows Mobile, so will deprecate the features that allowed the attack.
The critical-rated CVE-2018-6968 details a vulnerability that “may allow for unauthorized creation and execution of files in the Agent sandbox and other publicly accessible directories such as those on the SD card by a malicious administrator.”
The problem’s in the agent that VMware requires users to install on a mobile device in order to make it manageable by AirWatch.
There’s good news in the arrival of newly-fixed agents for each OS: VMware AirWatch Agent for Android 8.2 and VMware AirWatch Agent for Windows Mobile 6.5.2 should sort this one out.
There’s also a workaround for Android users who can choose C2DM/GCM instead of AWCM as their preferred push notification service. That change will avoid the need for an upgrade to the Android app.
But the problem’s not confied to devices: VMware’s also said that the the file, task and registry management in AirWatch Cloud Messaging will be “will be disabled in current SaaS environments over the coming weeks”. The functions will then be “deprecated in future releases of the Workspace ONE UEM Console.”
Which sounds like a decent idea: the fewer tools that can get into the innards of a device, the better. Especially when, as is the case with this bug, it’s also possible to write files to removable media. ®