VMware forced to patch critical vCenter Server RCE flaw for a second time following bad patch

VMware has been forced to merchandise a 2nd spot for a superior information vulnerability successful its vCenter Server level aft an first merchandise grounded to hole nan issue.

Users are advised to use nan hole immediately, since nan identified flaws are rather vulnerable and without a due workaround.

The bully news is that location is presently nary grounds of in-the-wild abuse, truthful possibly nan miscreants haven’t yet picked up connected them. However, since location are nary workarounds, and businesses are known to beryllium slow pinch patching, it’s only a matter of clip earlier they do.

No workaround

"All customers are powerfully encouraged to use nan patches presently listed successful nan Response Matrix," nan advisory reads.

In mid-September 2024, VMware released a information advisory, claiming to person patched 2 flaws successful vCenter Server that could person granted threat actors distant codification execution (RCE) abilities. These flaws were tracked arsenic CVE-2024-38812 and CVE-2024-38813.

The erstwhile affects vCenter 7.0.3, 8.9.2, and 8.0.3, arsenic good arsenic each versions of vSphere aliases VMware Cloud Foundation anterior to nan ones listed above. It was fixed a severity people of 9.8 (critical) since it tin beryllium exploited without personification interaction, and since it grants RCE capabilities to a threat character sending a custom-built web packet.

The latter, connected nan different hand, is simply a 7.5-severity flaw, granting guidelines privilege escalation.

According to The Register, these 2 flaws are peculiarly vulnerable erstwhile chained together, since a threat character could first remotely execute malicious code, and past summation administrative privileges for moreover much damage. What’s more, VMware systems are a celebrated target for ransomware operators and state-sponsored threat actors, fixed their omnipresence successful nan business world.

Both vulnerabilities were first discovered by Team TZL astatine Tsinghua University, during nan Matrix Cup Cyber Security Competition, held successful China earlier this year, nan publication added.

Via The Register

More from TechRadar Pro

• Mystery database containing delicate info connected 762,000 car-owners discovered by researchers
• Here's a database of nan best firewalls today
• These are nan best endpoint protection tools correct now