Skip to content

Defense Digests

VMware vCenter Remote Code Execution Vulnerability

Dataprise Defense Digest 550x550

Table of content

Dataprise Defense Digest

ID: D3-2023-0009-1

Published October 26. 2023

Severity: 9.8/10

Executive Summary

On October 24, 2023, VMware released security advisory VMSA-2023-0023 to address an out of bounds write vulnerability in their implementation of the DCE/RPC protocol. This vulnerability is tracked as CVE-2023-34048 with a CVSS score of 9.8 out of 10. This vulnerability can potentially lead to Remote Code Execution (RCE) if a threat actor has network access to the vCenter server. VMware has released updates fixing this issue and there are no known workarounds without updating.

Additionally, VMware has included with this update a patch for CVE-2023-34056, an information disclosure vulnerability which had been partially remediated by September’s updates. According to VMware, this vulnerability could allow a non-administrative user to obtain unauthorized data/information from the vCenter server. This has been rated with a CVSS score of 4.3 out of 10.

Dataprise is aware of the critical nature of this vulnerability and is conducting a review of all available analyses of these vulnerabilities and the potential impact on our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customerfacing service interruptions. If your organization’s VMWare vCenter is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts.

Detailed Analysis

Due to the large scope of affected machines and the critical nature of RCEs, VMware has not released details of how this RCE is achieved through the vulnerability. They have released patches to older end-of-life versions of vSphere but strongly recommend upgrading to at least 7.0U3o, ideally 8.0U2.

If patching needs to be scheduled, reviewing and restricting network access to the vCenter server would be a good measure to minimize the attack surface. It is especially important to prevent the server from being accessible over WAN. Ideally only a maintenance server would be able to administer the vCenter server over LAN.

Affected Versions

  • vSphere 6.5 below 6.5.0.42000 – Upgrade to version 6.5 U3v
  • vSphere 6.7 below 6.7.0.55000 – Upgrade to version 6.7 U3t
  • vSphere 7.0 below 7.0.3.01700 – Upgrade to version 7.0U3o
  • vSphere 8.0.1 below 8.0.1.00400 – Upgrade to version 8.0U2
  • vSphere 8.0.2 below 8.0.2.00000 – Upgrade to version 8.0U2
  • VMware Cloud Foundation 3.x, 4.x, 5.x – Refer to KB88287 for instructions using the Asynchronous Patch Tool

Sources

Contributing Authors

  • Stephen Jones, VP Cybersecurity
  • Nicholas Tenney, Cybersecurity Analyst

Recent Tweets

INSIGHTS

Learn about the latest threats and vulnerabilities with our D3 alerts.

Subscribe to get real-time notifications when a new Dataprise Defense Digest is published.