CVE-2020-3946: 
VMware InstallBuilder vulnerability analysis and mitigation

CVE-2020-3946 affects InstallBuilder's AutoUpdate tool, specifically versions earlier than 19.11.0. The vulnerability was discovered in the handling of malformed update.xml files and was disclosed in December 2019. The issue impacts InstallBuilder AutoUpdate tool and regular installers with built-in update functionality (InstallBuilder Blog).

The vulnerability is related to XML entity expansion attacks, specifically the Billion Laughs attack pattern. When checking for updates, the AutoUpdate tool retrieves an XML file from a remote server containing version information. This XML is loaded into memory on the user's machine, where a specially crafted malicious XML exploiting entity expansion could cause excessive memory consumption (InstallBuilder Blog). The vulnerability has been assigned a CVSSv3 score of 5.4.

If successfully exploited, the vulnerability can lead to a Denial of Service (DoS) condition by consuming system memory until the AutoUpdate process crashes (InstallBuilder Blog).

Exploitation requires an attacker to either place a malicious XML file on the updates remote server, impersonate it through DNS spoofing, or modify the updates URL in the user machine's updates.ini file (InstallBuilder Blog).

The vulnerability was patched in InstallBuilder version 19.11.0. Affected customers using the AutoUpdate functionality or distributing the AutoUpdate should upgrade to version 19.11.0 or later and release new versions (InstallBuilder Blog).

The vulnerability was responsibly disclosed by Tesla Red Team to InstallBuilder's security team (InstallBuilder Blog).