From 1450a05df6736e5c7aeeb20534d0ad92e74aed8e Mon Sep 17 00:00:00 2001 From: Oscar Vlugt Date: Tue, 26 Nov 2024 19:18:15 +0100 Subject: [PATCH] Opening case 2024-00048 --- _cases/2024/DIVD-2024-00048.md | 56 ++++++++++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100644 _cases/2024/DIVD-2024-00048.md diff --git a/_cases/2024/DIVD-2024-00048.md b/_cases/2024/DIVD-2024-00048.md new file mode 100644 index 00000000..aafeb530 --- /dev/null +++ b/_cases/2024/DIVD-2024-00048.md @@ -0,0 +1,56 @@ +--- +layout: case +title: "VMware vCenter Server heap-overflow and remote code execution vulnerabilities" +author: Oscar Vlugt +lead: Oscar Vlugt +excerpt: "The vCenter Server contains a heap-overflow vulnerability and a privilege escalation vulnerability" +researchers: +- Oscar Vlugt +cves: +- CVE-2024-38812 +- CVE-2024-38813 +product: +- VMware vCenter +versions: +- vCenter 7 Update 3 lower than version 7.0 U3t (24322018) +- vCenter 8 Update 2 lower than version 8.0 U2e (24321653) +- vCenter 8 Update 3 lower than version 8.0 U3d (24322831) +recommendation: "Install the update as soon as possible" +workaround: "None" +patch_status: Available +status : Open +start: 2024-11-22 +#end: +timeline: +- start: 2024-11-22 + end: + event: "DIVD starts researching the vulnerability." +- start: 2024-11-22 + end: + event: "DIVD finds fingerprint, preparing to scan." +- start: 2024-11-26 + end: + event: "DIVD starts scanning the internet for vulnerable instances." +#ips: +--- + +## Summary + +The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote execution. vCenter Server also contains a privilege escalation vulnerability which allows an malicious actor to escalate privileges to root by sending a specially crafted network packet. + +## Recommendations + +To remediate CVE-2024-38812 and CVE-2024-38813 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below to affected deployments. You can find the 'Response Matrix' at the bottom of this post. + +## What we are doing + +DIVD is currently working to identify parties that are running a vulnerable version of vCenter Server and to notify these parties. We do this by looking at the version numbers if possible. Although our fingerprinting cannot confirm if instances are vulnerable to the initial attack vector, we want to issue a warning that a critical infrastructural component is exposed if it falls within the specified vulnerable versions. + +{% include timeline.html %} + +## More information + +* {% cve CVE-2024-38812 %} +* {% cve CVE-2024-38813 %} +* [Broadcom Advisory](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968) +* [VMSA-2024-0019: Questions & Answers](https://github.com/vmware/vcf-security-and-compliance-guidelines/blob/main/security-advisories/vmsa-2024-0019/README.md)