Amazon Web Services (AWS) has issued a critical security advisory highlighting vulnerabilities in specific versions of its native clients for Amazon WorkSpaces, Amazon AppStream 2.0, and Amazon NICE DCV.
Identified as CVE-2025-0500 and CVE-2025-0501, these vulnerabilities present significant risks, compelling AWS to recommend urgent updates to protect user data.
Overview of the Vulnerabilities
CVE-2025-0500
CVE-2025-0500 affects users of Amazon WorkSpaces and Amazon AppStream 2.0 when utilizing the Amazon NICE DCV protocol.
This vulnerability could allow malicious actors to execute man-in-the-middle attacks, enabling unauthorized access to remote WorkSpaces, AppStream, or DCV sessions.
Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free
The versions affected by this vulnerability include Amazon WorkSpaces Windows client 5.20.0 or earlier, macOS client 5.20.0 or earlier, and Linux client 2024.1 or earlier.
Additionally, the vulnerability impacts the Amazon AppStream 2.0 Windows client version 1.1.1326 or earlier, as well as Amazon DCV Windows client version 2023.1.8993 or earlier, macOS client version 2023.1.6203 or earlier, and Linux client version 2023.1.6203 or earlier for all supported distributions.
To address this vulnerability, AWS recommends that users upgrade to the following versions or later: Amazon WorkSpaces Windows client 5.21.0 or later, macOS client 5.21.0 or later, and Linux client 2024.2 or later.
For Amazon AppStream 2.0, users should update to Windows client version 1.1.1332 or later.
For Amazon DCV, the recommended updates are Windows client version 2023.1.9127 or later, macOS client version 2023.1.6703 or later, and Linux client version 2023.1.6703 or later for all supported distributions.
CVE-2025-0501
The second vulnerability, CVE-2025-0501, applies specifically to Amazon WorkSpaces when using the Amazon PCoIP protocol.
Similar to CVE-2025-0500, this issue could enable attackers to perform man-in-the-middle attacks, compromising remote WorkSpaces sessions.
Affected versions for this vulnerability include Amazon WorkSpaces Windows client 5.22.0 or earlier, macOS client 5.22.0 or earlier, Linux client 2024.5 or earlier, and Android client 5.0.0 or earlier.
To mitigate the risks associated with CVE-2025-0501, users are advised to upgrade to the following versions or later: Amazon WorkSpaces Windows client 5.22.1 or later, macOS client 5.22.1 or later, Linux client 2024.6 or later, and Android client 5.0.1 or later.
Recommendations for AWS Users
In light of these vulnerabilities, AWS emphasizes the critical importance of maintaining updated software versions to protect sensitive data and ensure a secure working environment.
The company has proactively communicated with its customers regarding the end of support for the affected versions, reinforcing the urgency for users to upgrade.
Organizations utilizing AWS services should adopt best practices by regularly implementing updates and conducting vulnerability assessments.
Staying informed through AWS advisories and security bulletins is vital for maintaining robust security postures in cloud environments.
Ensuring that all clients operate on supported versions will not only help mitigate potential risks but also enhance overall security protocols within the organization.
Integrating Application Security into Your CI/CD Workflows Using Jenkins & Jira -> Free Webinar
