Category: IT|Apr 17, 2020 | Author: Admin

Critical Vulnerability In VMware vCenter Server Threatened Information Disclosure

Share on

VMware has disclosed another serious vulnerability affecting its vCenter Server. The vulnerability, upon exploitation, could lead to information disclosure.

vmware.jpeg

VMware vCenter Server Vulnerability According to a recent advisory, a critical security vulnerability existed in the VMware vCenter Server product. vCenter Server serves as a centralized platform for managing virtualized hosts and VMs. Specifically, the bug, CVE-2020-3952, existed in the vmdir component of the VMware vCenter Server.

As revealed, the critical severity vulnerabilities were rated with a CVSS score of 10.0 could leak sensitive information to an adversary. Describing the flaw in detail, the advisory reads,

A malicious actor with network access to an affected vmdir deployment may be able to extract highly sensitive information which could be used to compromise vCenter Server or other services which are dependent upon vmdir for authentication.

VMware Released Fixes The vulnerability caught the attention of the vendors following a private disclosure. For now, they haven’t revealed the name of the researcher who reported this flaw. Presently, no workaround is available to mitigate the flaw. The vendors have patched the vulnerability that affected version 6.7 with the release of version 6.7u3f.

Yet, it only affected the versions upgraded from version 6.0 or 6.5, and not the clean installations of vCenter Server 6.7. Apart from releasing the patched version, VMware has also shared a dedicated advisory KB78543 regarding the impact of the flaw on a particular version.

Users may simply protect their devices from exploitation by upgrading to version 6.7u3f or 7.0. In the previous month, VMware fixed a critical vulnerability in the Workstation Pro as well. That critical vulnerability could allow guest apps to execute code on the host machine. It may also allow an adversary to create a dos state on the target machine. Eventually, following the ZDI researcher’s report, the vendors patched the flaw along with other bugs. Let us know your thoughts in the comments.

Sponsored Ads:

Comments:


Slack.jpg

Slack begins rolling out video and audio message ‘clips’

Category: General|Sep 22, 2021 | Author: Admin
roku.webp

Roku's free OS 10.5 lets you dictate passwords, fixes pesky sound lags on headphones

Category: IT|Sep 21, 2021 | Author: Admin
Apple.webp

Some good news and some strange news from Apple

Category: Apple|Sep 20, 2021 | Author: Admin
broken-windows-header.jpg

New Windows security updates break network printing

Category: Microsoft|Sep 19, 2021 | Author: Admin
Project-Taara-1155x770.webp

Sent 700tb over 4 km of laser technology

Category: IT|Sep 18, 2021 | Author: Admin
Fiber.jpg

'Massive' transatlantic data cable landed on beach in Bude

Category: Google|Sep 17, 2021 | Author: Admin
Discord.png

YouTube shuts down Discord music bot ‘Rythm’

Category: Google|Sep 16, 2021 | Author: Admin
Facebook.webp

Facebook's secret rules differentiate between the "elite" and most people

Category: General|Sep 15, 2021 | Author: Admin
Apple.webp

Apple suddenly had to crisis-update the iPhone and Mac

Category: Apple|Sep 14, 2021 | Author: Admin
Epic.webp

Epic is blocked forever on all Apple platforms

Category: Apple|Sep 13, 2021 | Author: Admin
Desktop-Screenshot.png

NVIDIA To Launch GeForce RTX 30 SUPER ‘Ampere Refresh’ In January 2022, GeForce RTX 40 ‘Ada Lovelace’ GPUs in October 2022

Category: General|Sep 12, 2021 | Author: Admin
chrome-os-secret-weapon-100856418-large.jpg

3 smart shortcuts for a curiously hidden Chrome OS command

Category: Google|Sep 11, 2021 | Author: Admin
sunset-gold-iphone-13-render.png

iPhone 13 unveiled in Ukraine

Category: Apple|Sep 10, 2021 | Author: Admin
iCloud.jpg

Apple brings iCloud passwords to Windows, Microsoft's Edge

Category: Apple|Sep 9, 2021 | Author: Admin
AI.webp

AI will determine if you are allowed to drive

Category: General|Sep 8, 2021 | Author: Admin
more