VMware addressed critical vCenter flaw also for End-of-Life products

VMware addressed a critical out-of-bounds write vulnerability, tracked as CVE-2023-34048, that impacts vCenter Server.

vCenter Server is a critical component in VMware virtualization and cloud computing software suite. It serves as a centralized and comprehensive management platform for VMware’s virtualized data centers.

The vulnerability CVE-2023-34048 (CVSS score 9.8) is an out-of-bounds write vulnerability in the implementation of the DCERPC protocol.

“vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.” reads the advisory. “A malicious actor with network access to vCenter Server may trigger an out-of-bounds write potentially leading to remote code execution.”

The vulnerability was reported by Grigory Dorodnov through the Trend Micro Zero Day Initiative.

Due to the critical severity of this issue and lack of workaround, VMware has released a patch generally available for vCenter Server 6.7U3, 6.5U3, and VCF 3.x, which are end-of-life products. For the same reasons, VMware has made additional patches available for vCenter Server 8.0U1.

The virtualization giant also addressed a partial information disclosure vulnerability tracked as CVE-2023-34056 (CVSS score 4.3). An attacker with non-administrative privileges to vCenter Server can trigger this flaw to access sensitive data.

The flaw was reported by Oleg Moshkov of Deiteriy Lab OÜ.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CVE-2023-34048)