{"id":24954,"date":"2023-06-28T06:32:56","date_gmt":"2023-06-28T06:32:56","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=24954"},"modified":"2023-06-28T06:32:56","modified_gmt":"2023-06-28T06:32:56","slug":"vmware-vcenter-server-multiple-high-risk-vulnerabilities-notification","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/vmware-vcenter-server-multiple-high-risk-vulnerabilities-notification\/","title":{"rendered":"VMware vCenter Server Multiple High Risk Vulnerabilities Notification"},"content":{"rendered":"\n

Overview<\/h2>\n\n\n\n

Recently, NSFOCUS CERT found that VMware’s official security announcement disclosed multiple vulnerabilities in VMware vCenter Server, which could be used by attackers to cause remote code execution, cross-border write and read, etc. Currently, the official version has been updated and fixed. Affected users should take protective measures as soon as possible.<\/p>\n\n\n\n

Key Vulnerabilities<\/h2>\n\n\n\n

vCenter Server<\/strong> Heap Overflow Vulnerability (CVS 2023-20892):<\/strong><\/p>\n\n\n\n

Due to the use of uninitialized memory in the implementation of the DCERPC protocol, malicious attackers with network access to the vCenter Server can exploit this vulnerability to execute arbitrary code on the underlying operating system using the vCenter Server, with a CVSS score of 8.1.<\/p>\n\n\n\n

UAF Vulnerability<\/strong> of vCenter Server<\/strong> (CVS 2023-20893):<\/strong><\/p>\n\n\n\n

There is a UAF vulnerability in the implementation of the DCERPC protocol in vCenter Server, which allows malicious attackers with network access to vCenter Server to execute arbitrary code on the underlying operating system using vCenter Server. The CVSS score is 8.1.<\/p>\n\n\n\n

vCenter Server<\/strong> Out of Bound Write Vulnerability (CVS 2023-20894):<\/strong> <\/p>\n\n\n\n

There is an out of bounds write vulnerability in the implementation of the DCERPC protocol in vCenter Server. Malicious attackers with network access to vCenter Server can trigger out of bounds writes by sending specially crafted packets, resulting in memory corruption. The CVSS score is 8.1.<\/p>\n\n\n\n

vCenter Server<\/strong> Out-of-Bounds Read Vulnerability (CVE-2023-20895):<\/strong> <\/p>\n\n\n\n

There is an out-of-bounds read vulnerability in the implementation of the DCERPC protocol in vCenter Server, which can be exploited by malicious attackers with network access to vCenter Server to cause memory corruption and bypass authentication. The CVSS score is 8.1.<\/p>\n\n\n\n

vCenter Server<\/strong> Out-of-Bounds Read Vulnerability (CVE-2023-20896):<\/strong> <\/p>\n\n\n\n

There is an out-of-bounds read vulnerability in the implementation of the DCERPC protocol in vCenter Server. Malicious attackers with network access to vCenter Server can trigger out of bounds reads by sending crafted packets, resulting in a denial of service for certain services (vmcad, vmdird, and vmafdd), with a CVSS score of 5.9.<\/p>\n\n\n\n

Scope of Impact<\/h2>\n\n\n\n

Affected version <\/a><\/a><\/strong><\/p>\n\n\n\n