VMware Addresses Patches for Cloud Foundation, vCenter Server, and vSphere ESXi

June 18, 2024NewsroomNetwork Security / Vulnerability

VMware has issued patches to fix critical vulnerabilities affecting Cloud Foundation, vCenter Server, and vSphere ESXi that could be exploited for privilege escalation and remote code executio

June 18, 2024NewsroomNetwork Security / Vulnerability

VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi

VMware has issued patches to fix critical vulnerabilities affecting Cloud Foundation, vCenter Server, and vSphere ESXi that could be exploited for privilege escalation and remote code execution.

Here is the list of vulnerabilities:

CVE-2024-37079 & CVE-2024-37080 (CVSS scores: 9.8) – Multiple heap-overflow vulnerabilities in the implementation of the DCE/RPC protocol, allowing a malicious actor with network access to vCenter Server to execute remote code by sending a specially crafted network packet.

CVE-2024-37081 (CVSS score: 7.8) – Multiple local privilege escalation vulnerabilities in VMware vCenter due to sudo misconfiguration, enabling an authenticated local user with non-administrative privileges to gain root permissions.

VMware previously addressed issues with the DCE/RPC protocol in October 2023 when the virtualization services provider, owned by Broadcom, fixed another critical security flaw (CVE-2023-34048, CVSS score: 9.8) that could also be exploited for remote arbitrary code execution.

The discovery of CVE-2024-37079 and CVE-2024-37080 is credited to researchers Hao Zheng and Zibo Li from the Chinese cybersecurity firm QiAnXin LegendSec. CVE-2024-37081 was discovered and reported by Matei “Mal” Badanoiu at Deloitte Romania.

All three vulnerabilities affecting vCenter Server versions 7.0 and 8.0 have been fixed in releases 7.0 U3r, 8.0 U1e, and 8.0 U2d.

Although there are no current reports of active exploitation of these vulnerabilities, it is crucial for users to promptly apply the patches given their critical nature.

If you found this article interesting, follow us on Twitter and LinkedIn for more exclusive content.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts