VMware-workstation-full-17.6.4-24832109.exe Scan issues

[Aaron NANA NONO]

Hello,

In the process of installing the VMWare Workstation Pro 17.6.4 , the scan for vulnerabilities raised several issues ( See full scan report in attachment ).

We decided to try installing the latest version VMware-workstation-full-17.6.4-24832109.exe | 26H1 and the scan also raised several issues ( See full scan report in attachment )

I would like to loop in our IT Support Engineer that is in charge of completing the Software Scans - Her contact details below if needed. 

Semtetam, Adalberta <[e-mail]>

Please help review and let us know as soon as possible how the issues can be resolved

Sincerely, Aaron

Attachment(s)

VMware Workstation Pro 17 report.summary.pdf   107 KB 1 version

VMware Station 26H1 report.summary.pdf   110 KB 1 version

[Allan Solomon Mejia]

Hello Aaron,

I compared the results for Workstation Pro 17.6.4 and the newer 26H1 scan. One important point is that neither report identifies a known vulnerability. Both show 0 vulnerabilities, with all 7 vulnerability policies passing.

 

The findings appear to be primarily related to signature/integrity and executable-format analysis, rather than confirmed CVEs. For 17.6.4, ReversingLabs reports two tampered signatures and three malware findings, including Win32.Certificate.Invalid, Win64.Certificate.Invalid, and Win64.Format.Malformed.

 

The 26H1 scan similarly reports two tampered signatures, but four malware findings: two Win64.Certificate.Invalid, one Win32.Format.Malformed, and one Win64.Format.Malformed.

 

Interestingly, upgrading therefore doesn't eliminate the scanner findings. The reports themselves also mention failed signature-integrity validation, package-integrity checks, malformed executable structures, and overlapping PE data/header structures.

 

That does not by itself establish that the VMware installer contains malware. Static-analysis tools can flag unusual executable packaging, signing, embedded components, or PE structures. However, the failed signature/integrity findings shouldn't simply be ignored either.

 

I would suggest:

• Confirm that both installers were downloaded directly from the official Broadcom/VMware download portal. Broadcom documents the current Workstation download process through its Support Portal.
• Compare the installer checksum against the checksum published for that download, if available.
• On Windows, check Properties → Digital Signatures → Details and confirm that Windows reports the signature as valid and inspect the signer/certificate chain.
• If the official Broadcom-downloaded binary still produces the ReversingLabs Certificate.Invalid / tampered-signature findings, provide Broadcom Support with the SHA-256 hash and these reports so they can determine whether this is expected packaging/signing behavior or something requiring remediation.

 

Broadcom's own documentation shows that signature-verification failures can have several causes, including trust/certificate issues, so I wouldn't classify these scan results as a confirmed VMware vulnerability or compromise without validating the actual affected files and signatures first.

 

Hope this helps clarify the scan results.

[Aaron NANA NONO]

Hi Allan

Please see below our follow up to your suggestions

• Confirm that both installers were downloaded directly from the official Broadcom/VMware download portal. Broadcom documents the current Workstation download process through its Support Portal. 

            ANN: Confirmed.

• Compare the installer checksum against the checksum published for that download, if available.

            ANN: No issues found

• On Windows, check Properties → Digital Signatures → Details and confirm that Windows reports the signature as valid and inspect the signer/certificate chain.

            ANN: Not applicable according to our Cybersecurity department

• If the official Broadcom-downloaded binary still produces the ReversingLabs Certificate.Invalid / tampered-signature findings, provide Broadcom Support with the SHA-256 hash and these reports so they can determine whether this is expected packaging/signing behavior or something requiring remediation.

          ANN: Please see below the SHA-256 and hash related to the two invalid certificates.

                   I've also provided a link and password to access the full report

                              - SHA256: a0ef9087607d9cad20b08139e73e41242e044ad5bd8cee141d3bad314586737f

                              - Hash: dde4ddc2556dc010ea530862f0ac8845baab333bcf1b7a9d49c231ebf36a438c

                              - Hash: d530f434163428dc8ff46c30149f1350e6bc517ce91c8b27f23929a133360246

                              - Full scan report link and password below:

Report link:

https://ca.secure.software/cityofcalgary/shareable-reports/hDcJ3QuXy6H-xgKX7KeW36bRvSlDFmif_IX9A9GfkKfdfXyowk-5JwwQB5HOfM_rg80NVn7hvfv_qQYOgm1c8udYXfV-E8P5MgP0hwpDWhi-pbsRVyn8YdllhmBwmk6jDJjmrxiYk5HMkDChflyiOIylcOCPAmAgHRY8xeRZy9w?fp=a0dbc0ec-8ec6-4d68-8402-bf3d5fe1332f

Password:

Y6tJSnjBI_2iSLEVi0QCEw

   Please review the details and advise how we should address the highlighted issues.

Sincerely, Aaron

[Allan Solomon Mejia]

Hi Aaron, 

Thank you for providing the ReversingLabs report. I reviewed the summary, and it provides some useful additional detail.

 

The report is specifically detecting two Win64.Certificate.Invalid findings and two tampered signatures. It also reports digital signatures failing integrity validation and package/content integrity-validation failures. At the same time, the scan reports no known vulnerabilities, so I wouldn't interpret this report alone as confirmation that the installer contains malicious code.

 

Since you've also confirmed that:

• the installer came directly from the official Broadcom download source; and
• the checksum verification did not identify a mismatch,

I think this now warrants review by Broadcom Engineering/Product Security to determine exactly which embedded components/signatures are triggering the integrity failures.

 

The next useful step would be to identify the specific files associated with the two Win64.Certificate.Invalid detections and the two malformed-format detections. The summary report doesn't appear to expose enough component-level information to determine whether these are expected packaging/signing artifacts, legacy embedded components, or something Broadcom needs to correct.

 

I would therefore not delete or modify the package to work around the scanner findings. Please provide Broadcom Support with the SHA-256, ReversingLabs report, Workstation version/build (17.6.4 / 24832109), and the component-level findings if available.

 

Since the integrity findings are reproducible against the official Broadcom package, Broadcom is best positioned to confirm whether these are known/expected scanner findings or an issue with the distributed package.

 

Thanks for providing the additional evidence. This definitely helps narrow the investigation.

[Aaron NANA NONO]

Hi Allan,

Thank you for your prompt follow-up.

The requested information should be in the provided ReversingLabs report link already provided below.

I've also included screenshots and supporting information.

If possible, please have Broadcom to contact me directly by phone or chat. I'll then loop in our Cybersecurity SME to review the report and answer questions

SHA256: The two binaries detected and failed

1.1 Path:binary_layer/stego/12

1.1 SHA256: dde4ddc2556dc010ea530862f0ac8845baab333bcf1b7a9d49c231ebf36a438c

1.2 Path: binary_layer/stego/14

1.2 SHA256: d530f434163428dc8ff46c30149f1350e6bc517ce91c8b27f23929a133360246

2.                  ReversingLabsReport link: https://ca.secure.software/cityofcalgary/shareable-reports/hDcJ3QuXy6H-xgKX7KeW36bRvSlDFmif_IX9A9GfkKfdfXyowk-5JwwQB5HOfM_rg80NVn7hvfv_qQYOgm1c8udYXfV-E8P5MgP0hwpDWhi-pbsRVyn8YdllhmBwmk6jDJjmrxiYk5HMkDChflyiOIylcOCPAmAgHRY8xeRZy9w?fp=a0dbc0ec-8ec6-4d68-8402-bf3d5fe1332f

Password: Y6tJSnjBI_2iSLEVi0QCEw

3.  VMware Workstation version/build: 26.0.0build-25388281
4. component-level findings if available: There are 166 components and dependencies - see in the ReversingLab report as shown in the screenshot below

Sincerely,

Aaron NANA NONO, P.Eng.

Communications Engineer, Transit Service Systems

The City of Calgary 

C 403.966.4483 | E [e-mail]

[Harsha Bhat]

Hi Aaron,

The reports do not have much details as Allan pointed out in above comment. Please follow Allan's suggestions and if Broadcom-downloaded binary still show the issues, please provide detailed results of the scan.

[kasper]

It looks like you are looking for a business virtualization solution.  You may want to look at VMWare ESXi instead.   I do not see this as a solution for financial transaction nor for confidential/private business/government, etc. data.

[RaSystemlord]

Kasper is right.

Based on your original post, you are looking for a product with official support. Freeware (no reason to try to define what kind of "Freeware" we are talking about) does not provide you predictable, professional support - if that is what you are after.

Similarly, there has been - elsewhere - requirements for ordinary users not being able to change VMware settings on their own computer - VMware Workstation cannot be the product for any of this.

VMware Horizon is a nice virtualization product - also for 3D graphics - providing good performance from any user platform, over slow internet connections, but it is not freeware. There you can implement any professional security protocols that you want - if those are requirement. You can also run your own Virtual computers for any dedicated purpose in VMware Horizon, always remotely, I mean.