MTS has seen an increase in failed patches. We have researched the cause.

VMware forced to patch critical vCenter Server RCE flaw for a second time following bad patch

News

By Sead Fadilpašić

published October 23, 2024

The first patch, released more than a month ago, failed to plug the hole.

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

(Image credit: Shutterstock / Thapana_Studio)

VMware has been forced to release a second patch for a serious security vulnerability in its vCenter Server platform after an initial release failed to fix the issue.

Users are advised to apply the fix immediately, since the identified flaws are quite dangerous and without a proper workaround.

The good news is that there is currently no evidence of in-the-wild abuse, so perhaps the miscreants haven’t yet picked up on them. However, since there are no workarounds, and businesses are known to be slow with patching, it’s only a matter of time before they do.

Sponsored Links

Artificial Intelligence Gives Traders a Heads-Up on What's Coming NextVantagePoint

Learn More

No workaround

"All customers are strongly encouraged to apply the patches currently listed in the Response Matrix," the advisory reads.

In mid-September 2024, VMware released a security advisory, claiming to have patched two flaws in vCenter Server that could have granted threat actors remote code execution (RCE) abilities. These flaws were tracked as CVE-2024-38812 and CVE-2024-38813.

The former affects vCenter 7.0.3, 8.9.2, and 8.0.3, as well as all versions of vSphere or VMware Cloud Foundation prior to the ones listed above. It was given a severity score of 9.8 (critical) since it can be exploited without user interaction, and since it grants RCE capabilities to a threat actor sending a custom-built network packet.

The latter, on the other hand, is a 7.5-severity flaw, granting root privilege escalation.

According to The Register, these two flaws are particularly dangerous when chained together, since a threat actor could first remotely execute malicious code, and then gain administrative privileges for even more damage. What’s more, VMware systems are a popular target for ransomware operators and state-sponsored threat actors, given their omnipresence in the business world.

Both vulnerabilities were first discovered by Team TZL at Tsinghua University, during the Matrix Cup Cyber Security Competition, held in China earlier this year, the publication added.

Via The Register