Experts shed the light on the mysterious critical VMware vCenter Server issue

guest · Apr 19, 2020

Experts shed the light on the mysterious critical VMware vCenter Server issue
The bug — rated 10 in severity — potentially affects large numbers of corporate VMs and hosts
April 17, 2020
https://securityaffairs.co/wordpress/101805/security/vmware-vcenter-server-issue-details.html

Earlier this month, VMware has addressed a critical information disclosure flaw, tracked as CVE-2020-3952, that could be exploited by attackers to compromise vCenter Server or other services that use the Directory Service (vmdir) for authentication.

The CVE-2020-3952 vulnerability has received a CVSSv3 score of 10, it resides in the vCenter Server version 6.7 on Windows and virtual appliances.
According to VMware, the vulnerability could be exploited only on vCenter Server installs that ware upgraded from a previous version. Clean installs of vCenter Server 6.7 (embedded or external PSC) are not impacted.

Now experts at Guardicore analyzed the patch issued by VMware and released the technical analysis of the vulnerability.

“We were able to implement a proof of concept for this exploit that enacts a remote takeover of the entire vSphere deployment.” reads the post published by Guardicore.
“The vulnerability is enabled by two critical issues in vmdir’s legacy LDAP handling code: [...]
Click to expand...

Guardicore Labs: What’s a 10? Pwning vCenter with CVE-2020-3952

This was some rabbit hole. Despite the relative clarity of VMware’s code, it looks like there were quite a few missteps that went into the vulnerability. The developers were at least partially aware of them, too, as we saw in the code comments and commit messages.

Perhaps the most distressing thing, though, is the fact that the bugfix to VmDirLegacyAccessCheck was written nearly three years ago, and is only being released now. Three years is a long time for something as critical as an LDAP privilege escalation not to make it into the release schedule — especially when it turns out to be much more than a privilege escalation.
Click to expand...

Log in or Sign up

Experts shed the light on the mysterious critical VMware vCenter Server issue

guest Guest

Log in or Sign up

Experts shed the light on the mysterious critical VMware vCenter Server issue

guest Guest

Useful Searches