About the Vulnerability
Introduction
VMware vCenter is advanced server management software that provides a centralized platform for controlling the vSphere environment to achieve visibility across hybrid clouds.
Summary
On September 19, 2024, Sangfor FarSight Labs received notification that a VMware-vCenter component contains information of Buffer Overflow vulnerability(CVE-2024-38812), classified as critical in threat level.
In the vCenter Server, there is a buffer overflow vulnerability in the DCE (Distributed Computing Environment) RPC protocol implementation. Malicious attackers with network access to the vCenter Server can trigger this vulnerability by sending specially crafted network packets. By exploiting this vulnerability, attackers can execute arbitrary code, leading to server compromise.
Affected Versions
VMware vCenter Server 8.0 < 8.0 U3b
VMware vCenter Server 7.0 < 7.0 U3s
VMware Cloud Foundation 5.x < 8.0 U3b
VMware Cloud Foundation 4.x < 7.0 U3s
Solutions
Official Solution
Affected users are advised to update it to the latest version.
Official download links and documentation addresses:
https://support.broadcom.com/web/ecx/solutiondetails?patchId=5515
https://support.broadcom.com/web/ecx/solutiondetails?patchId=5513
https://knowledge.broadcom.com/external/article?legacyId=88287
Sangfor Solutions
Risky Assets Detection
Support is provided for proactive detection of VMware-vCenter; and it is capable of batch identifying the affected asset conditions of this event in business scenarios. Related products are as follows:
[Sangfor CWPP] has released an asset detection scheme, with Fingerprint ID: 0010456.
Timeline
On September 19, 2024, Sangfor FarSight Labs received notification of the VMware vCenter Buffer Overflow vulnerability.
On September 19, 2024, Sangfor FarSight Labs released a vulnerability alert.
