VMware vCenter Server Multiple High Risk Vulnerabilities Notification

Overview

Recently, NSFOCUS CERT found that VMware’s official security announcement disclosed multiple vulnerabilities in VMware vCenter Server, which could be used by attackers to cause remote code execution, cross-border write and read, etc. Currently, the official version has been updated and fixed. Affected users should take protective measures as soon as possible.

Key Vulnerabilities

vCenter Server Heap Overflow Vulnerability (CVS 2023-20892):

Due to the use of uninitialized memory in the implementation of the DCERPC protocol, malicious attackers with network access to the vCenter Server can exploit this vulnerability to execute arbitrary code on the underlying operating system using the vCenter Server, with a CVSS score of 8.1.

UAF Vulnerability of vCenter Server (CVS 2023-20893):

There is a UAF vulnerability in the implementation of the DCERPC protocol in vCenter Server, which allows malicious attackers with network access to vCenter Server to execute arbitrary code on the underlying operating system using vCenter Server. The CVSS score is 8.1.

vCenter Server Out of Bound Write Vulnerability (CVS 2023-20894):

There is an out of bounds write vulnerability in the implementation of the DCERPC protocol in vCenter Server. Malicious attackers with network access to vCenter Server can trigger out of bounds writes by sending specially crafted packets, resulting in memory corruption. The CVSS score is 8.1.

vCenter Server Out-of-Bounds Read Vulnerability (CVE-2023-20895):

There is an out-of-bounds read vulnerability in the implementation of the DCERPC protocol in vCenter Server, which can be exploited by malicious attackers with network access to vCenter Server to cause memory corruption and bypass authentication. The CVSS score is 8.1.

vCenter Server Out-of-Bounds Read Vulnerability (CVE-2023-20896):

There is an out-of-bounds read vulnerability in the implementation of the DCERPC protocol in vCenter Server. Malicious attackers with network access to vCenter Server can trigger out of bounds reads by sending crafted packets, resulting in a denial of service for certain services (vmcad, vmdird, and vmafdd), with a CVSS score of 5.9.

Scope of Impact

Affected version

• Series<8.0 U1b
• Series<7.0 U3m
• Series<8.0 U1b
• Series<7.0 U3m

Unaffected version

• Series=8.0 U1b
• Series=7.0 U3m
• Series=8.0 U1b
• Series=7.0 U3m

Mitigation

At present, the official has fixed the vulnerability in the latest version. Affected users are requested to upgrade the version as soon as possible. The download link for the corresponding product version is as follows:

Statement

This advisory is only used to describe a potential risk. NSFOCUS does not provide any commitment or promise on this advisory. NSFOCUS and the author will not bear any liability for any direct and/or indirect consequences and losses caused by transmitting and/or using this advisory. NSFOCUS reserves all the rights to modify and interpret this advisory. Please include this statement paragraph when reproducing or transferring this advisory. Do not modify this advisory, add/delete any information to/from it, or use this advisory for commercial purposes without permission from NSFOCUS.

About NSFOCUS

NSFOCUS, Inc., a global network and cyber security leader, protects enterprises and carriers from advanced cyber attacks. The company’s Intelligent Hybrid Security strategy utilizes both cloud and on-premises security platforms, built on a foundation of real-time global threat intelligence, to provide multi-layered, unified and dynamic protection against advanced cyber attacks.

NSFOCUS works with Fortune Global 500 companies, including four of the world’s five largest financial institutions, organizations in insurance, retail, healthcare, critical infrastructure industries as well as government agencies. NSFOCUS has technology and channel partners in more than 60 countries, is a member of both the Microsoft Active Protections Program (MAPP), and the Cloud Security Alliance (CSA).

A wholly owned subsidiary of NSFOCUS Technologies Group Co., Ltd., the company has operations in the Americas, Europe, the Middle East and Asia Pacific.