How to remediate – VMware Horizon View Client Detection

1. Introduction

VMware Horizon View Client Detection indicates that a desktop virtualization application is installed on a remote host. This means systems using VMware Horizon View are present in your environment, potentially introducing an attack surface. Successful exploitation could compromise confidentiality, integrity and availability of virtual desktops and associated data.

2. Technical Explanation

VMware Horizon View Client allows users to connect to virtual desktops hosted by VMware Horizon View. The presence of the client itself doesn’t represent a vulnerability but indicates a potential entry point for attacks targeting Horizon View. An attacker could exploit vulnerabilities within the Horizon View infrastructure through a compromised client machine with access to the network. There is currently no CVE associated with simply having the client installed.

• Root cause: The presence of the client software on a host does not represent a technical fault, but rather an indicator of a potentially vulnerable system depending on its configuration and connection to Horizon View servers.
• Exploit mechanism: An attacker could use a compromised client machine as a pivot point to access the Horizon View infrastructure if the client is misconfigured or connected to an insecure network.
• Scope: Windows operating systems are typically affected, as they are the primary platform for VMware Horizon View Client installations.

3. Detection and Assessment

Confirming the presence of the client software can help identify systems that may require further assessment. A quick check is possible via the Programs list in Control Panel. More thorough methods involve checking installed packages.

• Quick checks: Check for “VMware Horizon View Client” in the Windows Control Panel’s ‘Programs and Features’ list.
• Scanning: Nessus plugin ID 138659 can detect VMware Horizon View Client installations, but results should be verified.
• Logs and evidence: No specific logs directly indicate client presence; focus on installed application lists.

wmic product get name | findstr "VMware Horizon View Client"

4. Solution / Remediation Steps

The following steps outline how to assess and manage the risk associated with VMware Horizon View Client installations.

4.1 Preparation

• Dependencies: None. Roll back plan involves noting the initial presence of the client software and restoring from backup if necessary.
• Change window needs: Standard change control procedures apply, with approval required based on internal policies.

4.2 Implementation

1. Step 1: Inventory all systems where VMware Horizon View Client is installed.
2. Step 2: Assess the security configuration of each Horizon View deployment connected to these clients.
3. Step 3: Ensure that Horizon View servers are patched and up-to-date with the latest security releases.

4.3 Config or Code Example

There is no specific config change for client presence. The focus is on server configuration.

Before

N/A - Assessing existing Horizon View Server Configuration

After

Ensure Horizon View servers have latest security patches applied and are configured according to VMware best practices.

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help mitigate the risks associated with VMware Horizon View deployments.

• Practice 1: Least privilege – limit user access rights within the virtual desktop environment.
• Practice 2: Patch cadence – Regularly update Horizon View servers and clients to address known vulnerabilities.

4.5 Automation (Optional)

PowerShell can be used to inventory VMware Horizon View Client installations across multiple systems.

#Requires -RunAsAdministrator
$VMwareClients = Get-WmiObject -Class Win32_Product | Where-Object {$_.Name -like "*VMware Horizon View Client*"}
foreach ($Client in $VMwareClients) {
    Write-Host "Found VMware Horizon View Client: $($Client.Name) Version: $($Client.Version)"
}

5. Verification / Validation

Confirm the inventory and assessment steps have been completed successfully.

• Post-fix check: Re-run the command from step 3.1 to verify client installations are documented.
• Re-test: Check for “VMware Horizon View Client” in the Windows Control Panel’s ‘Programs and Features’ list.
• Monitoring: Monitor Horizon View server logs for suspicious activity or failed connection attempts.

wmic product get name | findstr "VMware Horizon View Client"

6. Preventive Measures and Monitoring

Proactive measures can help prevent similar issues in the future.

• Baselines: Update security baselines to include VMware Horizon View client software inventory.
• Pipelines: Integrate vulnerability scanning into CI/CD pipelines to identify unpatched systems.
• Asset and patch process: Implement a regular patch review cycle for all virtual desktop infrastructure components.

7. Risks, Side Effects, and Roll Back

Assessing Horizon View deployments carries minimal risk.

• Risk or side effect 1: Potential service disruption during patching; schedule maintenance windows accordingly.
• Roll back: Restore systems from backup if patching causes unexpected issues. Revert any configuration changes made to Horizon View servers.

8. References and Resources

• Vendor advisory or bulletin: https://www.vmware.com/products/horizon.html
• NVD or CVE entry: N/A – No specific CVE for client presence.
• Product or platform documentation relevant to the fix: https://docs.vmware.com/en/Horizon-View/index.html