VMware addressed critical vCenter flaw also for End-of
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2023-34048 +1 in the same advisory: …34056 | Unauthenticated Out-of-Bounds Write RCE in VMware vCenter Server VMware vCenter Server contains an out-of-bounds write vulnerability (CWE-787) in its implementation of the DCERPC protocol. A remote, unauthenticated attacker with network access to vCenter Server can send crafted DCERPC traffic that corrupts memory, potentially leading to remote code execution on the vCenter appliance. Because vCenter is the central management plane for VMware vSphere environments, full compromise of it hands attackers a high-value foothold for lateral movement, consistent with the critical 9.8 CVSS score. Any organization running an affected VMware vCenter Server release is exposed (exact version ranges per VMware's advisory, including VMware Cloud Foundation deployments that bundle vCenter). Exploitation is confirmed in the wild: the flaw was added to CISA's KEV on 2024-01-22, a public PoC is available, news reports describe China-linked APT UNC3886 exploiting it as a zero-day, and EPSS estimates a 99.4% probability of exploitation within 30 days. Do: Immediately upgrade vCenter Server — and VMware Cloud Foundation deployments that bundle it — to the patched builds identified in VMware's advisory, prioritizing internet-facing instances; if patching must wait, restrict network access to the vCenter management interface as the CISA KEV required action permits. Because exploitation is confirmed in the wild including by an APT, also hunt for signs of compromise such as unexpected processes or authentication activity on vCenter hosts and managed ESXi estate. | 9.8 group max | 99% | KEV PoC |
| mass≈100,000+ vCenter Server deployments globally (tens of thousands directly internet-exposed per public scans, far more reachable on internal networks) |
Full article245 words · extracted from securityaffairs.com · click to collapse
VMware addressed a critical out-of-bounds write vulnerability, tracked as CVE-2023-34048, that impacts vCenter Server.
vCenter Server is a critical component in VMware virtualization and cloud computing software suite. It serves as a centralized and comprehensive management platform for VMware’s virtualized data centers.
The vulnerability CVE-2023-34048 (CVSS score 9.8) is an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.
“vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.” reads the advisory. “A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.”
The vulnerability was reported by Grigory Dorodnov through the Trend Micro Zero Day Initiative.
Due to the critical severity of this issue and lack of workaround, VMware has released a patch generally available for vCenter Server 6.7U3, 6.5U3, and VCF 3.x, which are end-of-life products. For the same reasons, VMware has made additional patches available for vCenter Server 8.0U1.
The virtualization giant also addressed a partial information disclosure vulnerability tracked as CVE-2023-34056 (CVSS score 4.3). An attacker with non-administrative privileges to vCenter Server can trigger this flaw to access sensitive data.
The flaw was reported by Oleg Moshkov of Deiteriy Lab OÜ.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CVE-2023-34048)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/153031/security/vmware-fix-critical-vcenter-flaw.html