--- licence_title: Creative Commons Attribution 4.0 International (CC-BY 4.0) licence_link: https://creativecommons.org/licenses/by/4.0/ licence_restrictions: https://cert.europa.eu/legal-notice licence_author: CERT-EU, The Cybersecurity Service for the European Union institutions, bodies, offices and agencies title: 'Multiple Vulnerabilities in VMWare Products' version: '1.0' number: '2023-040' original_date: 'June 22, 2023' date: 'June 23, 2023' --- _History:_ * _23/06/2023 --- v1.0 -- Initial publication_ # Summary On June 22, VMWare released an advisory regarding multiple memory corruption high severity vulnerabilities in VMware vCenter Server. The affected software provides a centralised and extensible platform for managing virtual infrastructure [1,2]. The vulnerabilities were found in the DCERPC protocol implementation utilised by vCenter Server. The protocol allows for smooth operation across multiple systems by creating a virtual unified computing environment [3]. # Technical Details - `CVE-2023-20892` (CVSSv3 base score of 8.1) - a heap overflow vulnerability due to the usage of uninitialised memory in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may exploit this issue to execute arbitrary code on the underlying operating system that hosts vCenter Server. - `CVE-2023-20893` (CVSSv3 base score of 8.1) - a use-after-free vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to v…ut-of-bounds write vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger an out-of-bound write by sending a specially crafted packet leading to memory corruption. - `CVE-2023-20895` (CVSSv3 base score of 8.1) - a memory corruption vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger a memory corruption vulnerability which may bypass authentication. # Affected Products - vCenter Server 7.0 [1] - vCenter Server 8.0 [1] - Cloud Foundation (vCenter Server) 4.x [1] - Cloud Foundation (vCenter Server) 5.x [1] # Recommendations CERT-EU highly recommends installing the fixed versions as soon as possible: - vCenter Server 7.0 U3m [1] - vCenter Server 8.0 U1b [1] - Cloud Foundation (vCenter Server) 7.0 U3m [1] - Cloud Foundation (vCenter Server) 8.0 U1b [1] # References [1] [2] [3]