Skip to main content

VMware Releases Security Update

Update addresses five vulnerabilities in vCenter Server and Cloud Foundation

Threat ID:
CC-4346
Threat Severity:
Medium
Published:
23 June 2023 3:03 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Update addresses five vulnerabilities in vCenter Server and Cloud Foundation

Affected platforms

The following platforms are known to be affected:

Versions: 8.0 and previous

VMware vCenter Server

Versions: 8.0 and previous

VMware Cloud Foundation

Threat details

Introduction

VMware has released a security update, rated as Important, which includes four vulnerabilities with CVSSv3 scores of 8.1, and one with a score of 5.9. These vulnerabilities address heap overflow, out-of-bounds writing/reading, and memory corruption.

An attacker could exploit these vulnerabilities to execute arbitrary code, bypass authentication, or create a denial-of-service condition.

Remediation advice

Affected organisations are encouraged to review the VMware Security Advisory VMSA-2023-0014 and apply any relevant updates.

CVE Vulnerabilities

Status Published

CVE-2023-20892

The vCenter Server contains a heap overflow vulnerability due to the usage of uninitialized memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit heap-overflow vulnerability to execute arbitrary code on the underlying operating system that hosts vCenter Server.
Status Published

CVE-2023-20893

The VMware vCenter Server contains a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server.
 
Status Published

CVE-2023-20894

The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption.
Status Published

CVE-2023-20895

The VMware vCenter Server contains a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication.
 
Status Published

CVE-2023-20896

The VMware vCenter Server contains an out-of-bounds read vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bounds read by sending a specially crafted packet leading to denial-of-service of certain services (vmcad, vmdird, and vmafdd).

Last edited: 23 June 2023 3:03 pm