How to remediate – VMware Horizon View Client Detection (Linux)

1. Introduction

VMware Horizon View Client Detection (Linux) identifies instances where the VMware Horizon View client application is installed on a Linux host. This indicates a desktop virtualization component is present, potentially increasing the attack surface. Successful exploitation could allow local attackers to compromise the system. Confidentiality, integrity and availability may be impacted.

2. Technical Explanation

The presence of the VMware Horizon View Client does not represent an active vulnerability in itself but indicates a potential entry point for attacks targeting the client application or its interaction with the Horizon View server. An attacker gaining local access could exploit vulnerabilities within the client software. There is no specific CVE associated with simply having the client installed, however, known vulnerabilities exist within various versions of VMware Horizon View and its components.

• Root cause: The installation of a third-party application introduces potential security risks.
• Exploit mechanism: An attacker with local access could exploit known vulnerabilities in the Horizon View Client software to gain elevated privileges or compromise data. For example, an older version might be susceptible to buffer overflows.
• Scope: Linux systems running VMware Horizon View Client. Specific versions are not detailed within this report.

3. Detection and Assessment

Confirming the presence of the client is straightforward. Use quick checks for initial identification, followed by more thorough methods if needed.

• Quick checks: Run `dpkg -l | grep horizon-view` on Debian/Ubuntu systems or `rpm -qa | grep horizon-view` on Red Hat/CentOS/Fedora to list installed packages containing “horizon-view”.
• Scanning: Nessus plugin ID 16825 can detect VMware Horizon View Client installations. This is an example only, and may require updating.
• Logs and evidence: No specific logs are generated solely for client presence; package manager logs will show installation events.

dpkg -l | grep horizon-view

4. Solution / Remediation Steps

The primary remediation is to assess the need for the Horizon View Client and remove it if not required. If needed, ensure it’s updated to the latest version.

4.1 Preparation

• Change window: Standard change control procedures apply. Approval may be needed depending on your organisation’s policies.

4.2 Implementation

1. Step 1: Uninstall the Horizon View Client using the appropriate package manager command, for example `sudo apt remove horizon-view` or `sudo yum remove horizon-view`.
2. Step 2: Verify uninstallation by running the quick check command again (e.g., `dpkg -l | grep horizon-view`). The output should not show any Horizon View packages.

4.3 Config or Code Example

This vulnerability does not involve configuration changes, but package removal is shown.

Before

dpkg -l | grep horizon-view
ii  horizon-view                    1.2.0-1 amd64        VMware Horizon View Client

After

dpkg -l | grep horizon-view
(no output)

4.4 Security Practices Relevant to This Vulnerability

• Least privilege: Limit user access rights to reduce the impact if an attacker exploits a vulnerability in the client software.
• Asset management: Maintain an accurate inventory of all installed software to identify and remove unnecessary applications like Horizon View Client.

4.5 Automation (Optional)

No automation is provided as this involves package removal, which requires careful consideration.

5. Verification / Validation

• Post-fix check: Run `dpkg -l | grep horizon-view` or `rpm -qa | grep horizon-view`. The output should be empty.
• Re-test: Repeat the initial detection method to confirm the client is no longer present.
• Smoke test: Verify any dependent services still function as expected if Horizon View Client was used by them.
• Monitoring: Monitor package manager logs for unexpected re-installations of Horizon View packages.

dpkg -l | grep horizon-view

6. Preventive Measures and Monitoring

• Baselines: Update your system baseline to exclude unnecessary software like the Horizon View Client if it is not required.
• Pipelines: Implement software inventory scanning in CI/CD pipelines to identify unauthorized or unexpected software installations.
• Asset and patch process: Regularly review installed software on systems to ensure only necessary applications are present and up-to-date.

7. Risks, Side Effects, and Roll Back

• Roll back: Restore from the system snapshot/backup taken prior to removing the Horizon View Client.

8. References and Resources

• Vendor advisory or bulletin: https://www.vmware.com/products/horizon.html
• NVD or CVE entry: Not applicable for simply having the client installed.
• Product or platform documentation relevant to the fix: https://docs.vmware.com/en/Horizon-View/index.html