Description
The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | VMware vCenter Server | 8.0 – < 8.0 U3b, 7.0 – < 7.0 U3s | 8.0 U3b |
| — | VMware Cloud Foundation | 5.x, 4.x | — |
Advisories 2
- NCSC-2024-0377 Kwetsbaarheden verholpen in VMware vCenter Server NCSC-NL (Netherlands) · Nov 19, 2024
- WID-SEC-2024-2175 VMware vCenter Server: Mehrere Schwachstellen ermöglichen Codeausführung und Privilegienerweiterung BSI CERT-Bund (WID) · Nov 18, 2024