Summary: Broadcom has released critical updates to address a severe security vulnerability in VMware vCenter Server that could allow remote code execution. The flaws, identified as CVE-2024-38812 and CVE-2024-38813, were discovered during a cybersecurity competition and have been patched in various versions of the software.
Threat Actor: Malicious actors | malicious actors
Victim: VMware | VMware
Key Point :
- Critical vulnerability CVE-2024-38812 has a CVSS score of 9.8 and allows remote code execution via specially crafted network packets.
- VMware has also addressed a privilege escalation flaw (CVE-2024-38813) with a CVSS score of 7.5.
- Security researchers zbl and srs discovered these vulnerabilities during the Matrix Cup cybersecurity competition in June 2024.
- Broadcom advises customers to update their installations to mitigate potential threats, despite no known malicious exploitation at this time.
- The U.S. CISA and FBI have issued a joint advisory on the importance of eliminating cross-site scripting vulnerabilities in web applications.
Broadcom on Tuesday released updates to address a critical security flaw impacting VMware vCenter Server that could pave the way for remote code execution.
The vulnerability, tracked as CVE-2024-38812 (CVSS score: 9.8), has been described as a heap-overflow vulnerability in the DCE/RPC protocol.
“A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution,” the virtualization services provider said in a bulletin.
The shortcoming is similar to two other remote code execution flaws, CVE-2024-37079 and CVE-2024-37080 (CVSS scores: 9.8), that VMware resolved in vCenter Server in June 2024.
Also addressed by VMware is a privilege escalation flaw in the vCenter Server (CVE-2024-38813, CVSS score: 7.5) that could enable a malicious actor with network access to the instance to escalate privileges to root by sending a specially crafted network packet.
Security researchers zbl and srs of team TZL have been credited with discovering and reporting the two flaws during the Matrix Cup cybersecurity competition held in China back in June 2024. They have been fixed in the below versions –
- vCenter Server 8.0 (Fixed in 8.0 U3b)
- vCenter Server 7.0 (Fixed in 7.0 U3s)
- VMware Cloud Foundation 5.x (Fixed in 8.0 U3b as an asynchronous patch)
- VMware Cloud Foundation 4.x (Fixed in 7.0 U3s as an asynchronous patch)
Broadcom said it’s not aware of malicious exploitation of the two vulnerabilities, but has urged customers to update their installations to the latest versions to safeguard against potential threats.
“These vulnerabilities are memory management and corruption issues which can be used against VMware vCenter services, potentially allowing remote code execution,” the company said.
The development comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a joint advisory urging organizations to work towards eliminating cross-site scripting (XSS) flaws that threat actors could exploit to breach systems.
“Cross-site scripting vulnerabilities arise when manufacturers fail to properly validate, sanitize, or escape inputs,” the government bodies said. “These failures allow threat actors to inject malicious scripts into web applications, exploiting them to manipulate, steal, or misuse data across different contexts.”
Source: https://thehackernews.com/2024/09/patch-issued-for-critical-vmware.html