Merge pull request #878 from DIVD-NL/DIVD-2024-00048

Opening case 2024-00048

_cases/2024/DIVD-2024-00048.md

@@ -0,0 +1,56 @@
+---
+layout: case
+title: "VMware vCenter Server heap-overflow and remote code execution vulnerabilities"
+author: Oscar Vlugt
+lead: Oscar Vlugt
+excerpt: "The vCenter Server contains a heap-overflow vulnerability and a privilege escalation vulnerability"
+researchers:
+- Oscar Vlugt
+cves:
+- CVE-2024-38812
+- CVE-2024-38813
+product:
+- VMware vCenter
+versions: 
+- vCenter 7 Update 3 lower than version 7.0 U3t (24322018)
+- vCenter 8 Update 2 lower than version 8.0 U2e (24321653)
+- vCenter 8 Update 3 lower than version 8.0 U3d (24322831)
+recommendation: "Install the update as soon as possible"
+workaround: "None"
+patch_status: Available
+status : Open
+start: 2024-11-22
+#end: 
+timeline:
+- start: 2024-11-22
+  end:
+  event: "DIVD starts researching the vulnerability."
+- start: 2024-11-22
+  end:
+  event: "DIVD finds fingerprint, preparing to scan."
+- start: 2024-11-26
+  end:
+  event: "DIVD starts scanning the internet for vulnerable instances."
+#ips:
+---
+
+## Summary
+
+The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote execution. vCenter Server also contains a privilege escalation vulnerability which allows an malicious actor to escalate privileges to root by sending a specially crafted network packet.
+
+## Recommendations
+
+To remediate CVE-2024-38812 and CVE-2024-38813 apply the updates listed in the 'Fixed Version' column of the 'Response Matrix' below to affected deployments. You can find the 'Response Matrix' at the bottom of this post.
+
+## What we are doing
+
+DIVD is currently working to identify parties that are running a vulnerable version of vCenter Server and to notify these parties. We do this by looking at the version numbers if possible. Although our fingerprinting cannot confirm if instances are vulnerable to the initial attack vector, we want to issue a warning that a critical infrastructural component is exposed if it falls within the specified vulnerable versions. 
+
+{% include timeline.html %}
+
+## More information
+
+* {% cve CVE-2024-38812 %}
+* {% cve CVE-2024-38813 %}
+* [Broadcom Advisory](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24968)
+* [VMSA-2024-0019: Questions & Answers](https://github.com/vmware/vcf-security-and-compliance-guidelines/blob/main/security-advisories/vmsa-2024-0019/README.md)