Software Update Released to Address Critical VMware vCenter Vulnerability Enabling Remote Code Execution
Broadcom issued updates on Tuesday to fix a severe security weakness affecting VMware vCenter Server that could result in remote code execution.
The security flaw, identified as CVE-2024-38812 (CVSS score: 9.8), is a heap-overflow vulnerability in the DCE/RPC protocol.
The provider of virtualization services stated in a bulletin that “By transmitting a specifically crafted network packet, a hacker with network access to vCenter Server could exploit this vulnerability and potentially achieve remote code execution,”.
This vulnerability is comparable to two other remote code execution vulnerabilities, CVE-2024-37079 and CVE-2024-37080 (CVSS scores: 9.8), that were addressed by VMware in vCenter Server in June 2024.
VMware also addressed a privilege escalation vulnerability in the vCenter Server (CVE-2024-38813, CVSS score: 7.5) which could allow an attacker with network access to the instance to escalate privileges to root by sending a meticulously crafted network packet.
During the cybersecurity competition Matrix Cup held in China in June 2024, security researchers zbl and srs from team TZL were acknowledged for discovering and reporting these two vulnerabilities. The flaws have been resolved in the versions mentioned below –
- vCenter Server 8.0 (Resolved in 8.0 U3b)
- vCenter Server 7.0 (Resolved in 7.0 U3s)
- VMware Cloud Foundation 5.x (Resolved in 8.0 U3b as an asynchronous patch)
- VMware Cloud Foundation 4.x (Resolved in 7.0 U3s as an asynchronous patch)
Broadcom has stated that although there are no known instances of malicious exploitation of these two vulnerabilities, customers are advised to update to the latest versions to protect against potential threats.
“These vulnerabilities consist of memory management and corruption issues that may be exploited against VMware vCenter services, possibly allowing for remote code execution,” the company stated.
These developments occurred as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) jointly issued a combined advisory encouraging organizations to focus on eliminating cross-site scripting (XSS) vulnerabilities that malicious actors could exploit to infiltrate systems.
“Manufacturers’ inability to properly verify, sanitize, or escape inputs leads to the emergence of cross-site scripting vulnerabilities,” the governmental agencies explained. “These failures create opportunities for threat actors to embed harmful scripts into web applications, leveraging them to manipulate, steal, or misemploy data across diverse contexts.”
About Author
