About the Vulnerability
Introduction
VMware vCenter is advanced server management software that provides a centralized platform for controlling the vSphere environment to achieve visibility across hybrid clouds.
Summary
On September 19, 2024, Sangfor FarSight Labs received notification that a VMware-vCenter component contains information of Heap Overflow vulnerability(CVE-2024-38812), classified as critical in threat level. On October 22, 2024, Sangfor FarSight Labs released the second notice.
In the vCenter Server, there is a buffer overflow vulnerability in the DCE (Distributed Computing Environment) RPC protocol implementation. Malicious attackers with network access to the vCenter Server can trigger this vulnerability by sending specially crafted network packets. By exploiting this vulnerability, attackers can execute arbitrary code, leading to server compromise. Considering that the vCenter Server did not completely fix the vulnerability in the historical patches, on October 21, VMware officially released the latest patch update, which fully resolved the issue.
Affected Versions
VMware vCenter Server 8.0 < 8.0 U3d
VMware vCenter Server 8.0 < 8.0 U2e
VMware vCenter Server 7.0 < 7.0 U3t
VMware Cloud Foundation 5.x < 8.0 U3d
VMware Cloud Foundation 5.x < 8.0 U2e
VMware Cloud Foundation 4.x < 7.0 U3t
Solutions
Official Solution
Affected users are advised to update it to the latest version.
VMware vCenter Server 8.0 U3d
VMware vCenter Server 8.0 U2e
VMware vCenter Server 7.0 U3t
VMware Cloud Foundation 5.x 8.0 U3d
VMware Cloud Foundation 5.x 8.0 U2e
VMware Cloud Foundation 4.x 7.0 U3t
Official download links and documentation addresses:
VMware vCenter Server 8.0 U3d：
https://support.broadcom.com/web/ecx/solutiondetails?patchId=5574
VMware vCenter Server 8.0 U2e：
https://support.broadcom.com/web/ecx/solutiondetails?patchId=5531
VMware vCenter Server 7.0 U3t：
https://support.broadcom.com/web/ecx/solutiondetails?patchId=5580
Cloud Foundation 5.x/4.x：
https://knowledge.broadcom.com/external/article?legacyId=88287
Sangfor Solutions
Risky Assets Detection
Support is provided for proactive detection of VMware-vCenter; and it is capable of batch identifying the affected asset conditions of this event in business scenarios. Related products are as follows:
[Sangfor Host Security] has also released an asset detection scheme, with Fingerprint ID: 0010456.
Timeline
On September 19, 2024, Sangfor FarSight Labs received notification of VMware vCenter Server Heap Overflow vulnerability.
On September 19, 2024, Sangfor FarSight Labs released a vulnerability alert.
On October 23, 2024, Sangfor FarSight Labs released the second alert.
