Act Now: VMware Releases Patch for Critical vCenter Server RCE Vulnerability
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-34048 +1 in the same advisory: …34056 | Unauthenticated Out-of-Bounds Write RCE in VMware vCenter Server VMware vCenter Server contains an out-of-bounds write vulnerability (CWE-787) in its implementation of the DCERPC protocol. A remote, unauthenticated attacker with network access to vCenter Server can send crafted DCERPC traffic that corrupts memory, potentially leading to remote code execution on the vCenter appliance. Because vCenter is the central management plane for VMware vSphere environments, full compromise of it hands attackers a high-value foothold for lateral movement, consistent with the critical 9.8 CVSS score. Any organization running an affected VMware vCenter Server release is exposed (exact version ranges per VMware's advisory, including VMware Cloud Foundation deployments that bundle vCenter). Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-01-22, a public PoC is available, news reports describe China-linked APT UNC3886 exploiting it as a zero-day, and EPSS estimates a 99.4% probability of exploitation within 30 days. Do: Immediately upgrade vCenter Server — and VMware Cloud Foundation deployments that bundle it — to the patched builds identified in VMware's advisory, prioritizing internet-facing instances; if patching must wait, restrict network access to the vCenter management interface as the CISA KEV required action permits. Because exploitation is confirmed in the wild including by an APT, also hunt for signs of compromise such as unexpected processes or authentication activity on vCenter hosts and managed ESXi estate. | 9.8 group max | 99% | KEV PoC |
| mass≈100,000+ vCenter Server deployments globally (tens of thousands directly internet-exposed per public scans, far more reachable on internal networks) |
Full article265 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananOct 25, 2023Vulnerability / Cyber Threat
VMware has released security updates to address a critical flaw in the vCenter Server that could result in remote code execution on affected systems.
The issue, tracked as CVE-2023-34048 (CVSS score: 9.8), has been described as an out-of-bounds write vulnerability in the implementation of the DCE/RPC protocol.
"A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution," VMware said in an advisory published today.
Credited with discovering and reporting the flaw is Grigory Dorodnov of Trend Micro Zero Day Initiative.
VMware said that there are no workarounds to mitigate the shortcoming and that security updates have been made available in the following versions of the software -
- VMware vCenter Server 8.0 (8.0U1d or 8.0U2)
- VMware vCenter Server 7.0 (7.0U3o)
- VMware Cloud Foundation 5.x and 4.x
Given the criticality of the flaw and the lack of temporary mitigations, the virtualization services provider said it's also making available a patch for vCenter Server 6.7U3, 6.5U3, and VCF 3.x.
The latest update further addresses CVE-2023-34056 (CVSS score: 4.3), a partial information disclosure vulnerability impacting the vCenter Server that could enable a bad actor with non-administrative privileges to access unauthorized data.
VMware, in a separate FAQ, said it's not aware of in-the-wild exploitation of the flaws, but has recommended customers to act quickly to apply the patches as soon as possible to mitigate any potential threats.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2023/10/act-now-vmware-releases-patch-for.html