Tag Archives: DCERPC

On Monday, October 21, updates for the critical Remote Code Execution – VMware vCenter (CVE-2024-38812) vulnerability were released again

Leave a reply

On Monday, October 21, updates for the critical Remote Code Execution - VMware vCenter (CVE-2024-38812) vulnerability were released again

On Monday, October 21, updates for the critical Remote Code Execution – VMware vCenter (CVE-2024-38812) vulnerability were released again. Wait, haven’t fixes for this vulnerability been available since September 17th? They were, but it was not enough.

“VMware by Broadcom has determined that the vCenter patches released on September 17, 2024 did not completely address CVE-2024-38812. The patches listed in the Response Matrix below are updated versions that contain additional fixes to fully address CVE-2024-38812.”

If you are using VMware vCenter, please take note and update it again. Current secure versions of VMware vCenter Server are 7.0 U3t, 8.0 U2e and 8.0 U3d.

Updates are also available for the VMware Cloud Foundation.

На русском

September episode of “In The Trend of VM”: 7 CVEs, fake reCAPTCHA, lebanese pagers, VM and IT annual bonuses

Leave a reply

September episode of “In The Trend of VM”: 7 CVEs, fake reCAPTCHA, lebanese pagers, VM and IT annual bonuses. Starting this month, we decided to slightly expand the topics of the videos and increase their duration. I cover not only the trending vulnerabilities of September, but also social engineering cases, real-world vulnerability exploitation, and practices of vulnerability management process. At the end we announce a contest of questions about Vulnerability Management with gifts. 🎁

📹 Video “In The Trend of VM” on YouTube
🗞 A post on Habr (rus) a slightly expanded script of the video
🗒 A compact digest on the official PT website

Content:

🔻 00:51 Elevation of Privilege – Windows Installer (CVE-2024-38014) and details about this vulnerability
🔻 02:42 Security Feature Bypass – Windows Mark of the Web “LNK Stomping” (CVE-2024-38217)
🔻 03:50 Spoofing – Windows MSHTML Platform (CVE-2024-43461)
🔻 05:07 Remote Code Execution – VMware vCenter (CVE-2024-38812)
🔻 06:20 Remote Code Execution – Veeam Backup & Replication (CVE-2024-40711), while the video was being edited, data about exploitation in the wild appeared
🔻 08:33 Cross Site Scripting – Roundcube Webmail (CVE-2024-37383)
🔻 09:31 SQL Injection – The Events Calendar plugin for WordPress (CVE-2024-8275)
🔻 10:30 Human vulnerabilities: fake reCAPTCHA
🔻 11:45 Real world vulnerabilities: еxplosions of pagers and other electronic devices in Lebanon and the consequences for the whole world
🔻 14:42 Vulnerability management process practices: tie annual bonuses of IT specialists to meeting SLAs for eliminating vulnerabilities
🔻 16:03 Final and announcement of the contest
🔻 16:24 Backstage

На русском

About Remote Code Execution – VMware vCenter (CVE-2024-38812)

Leave a reply

About Remote Code Execution - VMware vCenter (CVE-2024-38812)

About Remote Code Execution – VMware vCenter (CVE-2024-38812). The vulnerability was published on September 17. An attacker with network access to the vCenter Server can send a specially crafted network packet and cause an RCE. This is due to a heap overflow in the DCERPC protocol implementation.

The vulnerability was discovered during The Matrix Cup competition by a team from Tsinghua University. There is no write-up yet. There is only one repository on GitHub, where some no-name sells the exploit for $105 (upd. A confirmed scam). On AttackerKB, another no-name claims to have seen the vulnerability exploited in the wild. The reliability is questionable.

However, we remember a similar RCE vulnerability vCenter DCERPC CVE-2023-34048, which has been exploited in targeted attacks since 2021. Censys reported then about 293 vCenter hosts with DCERPC accessible from the Internet.

Chances are high that there will be a big story with this vulnerability too.

На русском

Trending vulnerabilities for June according to Positive Technologies

Leave a reply

Trending vulnerabilities for June according to Positive Technologies. Traditionally, in 3 formats (in Russian):

📹 The section “Trending VM” in the SecLab news video (starts at 15:03)
🗞 Post on the Habr website, in fact this is a slightly expanded scenario for the “Trending VM” section
🗒 Compact digest with technical details on the official PT website

List of vulnerabilities:

🔻 EoP in Microsoft Windows CSC (CVE-2024-26229)
🔻 EoP in Microsoft Windows Error Reporting (CVE-2024-26169)
🔻 EoP in Microsoft Windows Kernel (CVE-2024-30088)
🔻 RCE in PHP (CVE-2024-4577)
🔻 EoP in Linux Kernel (CVE-2024-1086)
🔻 InfDisclosure in Check Point Security Gateways (CVE-2024-24919)
🔻 RCE in VMware vCenter (CVE-2024-37079, CVE-2024-37080)
🔻 AuthBypass in Veeam Backup & Replication (CVE-2024-29849)

На русском

Regarding the critical vulnerabilities Remote Code Execution – VMware vCenter (CVE-2024-37079, CVE-2024-37080)

Leave a reply

Regarding the critical vulnerabilities Remote Code Execution - VMware vCenter (CVE-2024-37079, CVE-2024-37080)

Regarding the critical vulnerabilities Remote Code Execution – VMware vCenter (CVE-2024-37079, CVE-2024-37080). vCenter is a product for centralized management of virtual infrastructure on the VMware vSphere platform.

Both vulnerabilities were fixed on June 17. They have the same description and CVSS 9.8.

The vulnerabilities are related to heap overflow in the implementation of the DCERPC protocol. An attacker with network access to vCenter Server sends a specially crafted network packet and potentially triggers RCE.

There is no public exploit or sign of exploitation in the wild yet, however:

🔸 The description of the vulnerabilities is very similar to last year’s actively exploited vCenter RCE (CVE-2023-34048).

🔸 The “screenshot of vSphere Client”, the vCenter interface, has become a kind of meme for attackers, confirming that the organization’s virtual infrastructure has been compromised.

Be sure to update!

На русском