VMware forced to patch critical vCenter Server RCE flaw for a second time following bad patch
The first patch, released more than a month ago, failed to plug the hole
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
VMware has been forced to release a second patch for a serious security vulnerability in its vCenter Server platform after an initial release failed to fix the issue.
Users are advised to apply the fix immediately, since the identified flaws are quite dangerous and without a proper workaround.
The good news is that there is currently no evidence of in-the-wild abuse, so perhaps the miscreants haven’t yet picked up on them. However, since there are no workarounds, and businesses are known to be slow with patching, it’s only a matter of time before they do.
No workaround
“All customers are strongly encouraged to apply the patches currently listed in the Response Matrix,” the advisory reads.
In mid-September 2024, VMware released a security advisory, claiming to have patched two flaws in vCenter Server that could have granted threat actors remote code execution (RCE) abilities. These flaws were tracked as CVE-2024-38812 and CVE-2024-38813.
The former affects vCenter 7.0.3, 8.9.2, and 8.0.3, as well as all versions of vSphere or VMware Cloud Foundation prior to the ones listed above. It was given a severity score of 9.8 (critical) since it can be exploited without user interaction, and since it grants RCE capabilities to a threat actor sending a custom-built network packet.
The latter, on the other hand, is a 7.5-severity flaw, granting root privilege escalation.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
According toThe Register, these two flaws are particularly dangerous when chained together, since a threat actor could first remotely execute malicious code, and then gain administrative privileges for even more damage. What’s more, VMware systems are a popular target for ransomware operators and state-sponsored threat actors, given their omnipresence in the business world.
Both vulnerabilities were first discovered by Team TZL at Tsinghua University, during the Matrix Cup Cyber Security Competition, held in China earlier this year, the publication added.
ViaThe Register
More from TechRadar Pro
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Cisco issues patch to fix serious flaw allowing possible industrial systems takeover
Washington state court systems taken offline following cyberattack
You’ve got until later today to vote for your Ultimate Game of the Year at the Golden Joystick Awards
