September 17, 2024 at 05:00PM
Broadcom has released two patches addressing critical vulnerabilities in VMware vCenter Server and Cloud Foundation. CVE-2024-38812 is a heap overflow flaw with a CVSS score of 9.8, enabling remote code execution. CVE-2024-38813 allows for privilege escalation and has a CVSS score of 7.5. Both vulnerabilities were discovered during a cyber security competition in China.
From the meeting notes, the takeaways are as follows:
1. Broadcom has released patches for vulnerabilities in VMware vCenter Server and Cloud Foundation that could allow a miscreant with network access to completely take control of a system. These vulnerabilities are CVE-2024-38812, a heap overflow vulnerability, and CVE-2024-38813, a privilege escalation flaw.
2. CVE-2024-38812 could be exploited over the network to achieve remote code execution and has a critical CVSS score of 9.8 out of 10.
3. CVE-2024-38813 allows someone with network access to gain root privileges on the system and has a CVSS score of 7.5.
4. Versions 7 and 8 of vCenter Server and versions 4 and 5 of VMware Cloud Foundation are at risk. Practical workarounds for these vulnerabilities are not available, so patching is necessary.
5. The vulnerabilities have been addressed in vCenter Server versions 8.0 U3b and 7.0 U3s, and Cloud Foundation with async patches to 8.0 U3b and 7.0 U3s.
6. The vulnerabilities were discovered during the Matrix Cup Cyber Security Competition in China, and the team credited with discovering the bugs received the Best Vulnerability Award and a prize of $59,360.
These are the key takeaways from the meeting notes regarding the vulnerabilities in VMware vCenter Server and Cloud Foundation.