VMware urges vCenter customers to immediately patch their systems
The company warns that ransomware gangs are primed to exploit two flaws to conduct remote code execution attacks
VMware is urging its customers to update vCenter Server versions 6.5, 6.7 and 7.0 immediately after fixing two vulnerabilities that could allow attackers to launch remote code execution attacks.
The most severe bug is tracked as CVE-2021-21985 which lies in the vSphere Client. This flaw involves a lack of input validation in the Virtual SAN Health Check plugin, which is enabled by default in the system.
The vSAN system is a software-defined storage platform that's used to eliminate the need for additional storage boxes using the local server storage. The health check plugin enhances customer support and user experience by allowing customers to manage their virtual deployments, including dozens of automated health checks.
The vulnerability is rated 9.8 on the CVSS threat severity scale and could allow hackers with network access to port 443 to execute commands with unrestricted privileges on the operating system that hosts vCenter Server. The high base score suggests the effects are particularly devastating, and the vulnerability is relatively easy to exploit.
The second vulnerability, tracked as CVE-2021-21986, is less severe, but nonetheless would allow attackers with network access to port 443 on vCenter Server to perform actions allowed by the impacted plugins without authentication.
This vulnerability concerns a vSphere authentication mechanism for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager and VMware Cloud Director Availability plugins in the vSphere Client.
The bugs are extremely serious, VMware has warned, and customers are being advised to patch immediately.
"With the threat of ransomware looming nowadays the safest stance is to assume that an attacker may already have control of a desktop and a user account through the use of techniques like phishing or spearphishing, and act accordingly," the firm says in its FAQs.
"This means the attacker may already be able to reach vCenter Server from inside a corporate firewall, and time is of the essence."
RELATED RESOURCE
Five lessons learned from the pivot to a distributed workforce
Improve employee experience and support IT teams for a more adaptable distributed workforce
The issue affects all vCenter Server customers, not just those who use vSAN, because this plugin is shipped with all systems and is enabled by default. The company doesn't advise disabling the vSAN plugin, because manageability and monitoring will not be possible, and customers using vSAN should only disable the plugin for short periods of time.
Warning of the dangers, VMware said in its FAQs that customers without perimeter security controls on their virtualisation infrastructure may be in jeopardy. Ransomware gangs, particularly, have demonstrated they can compromise corporate networks and subsequently wait for new vulnerabilities in order to attack from inside a network.
The fear is very real given that ransomware operators had previously exploited critical ESXi and vSphere Client flaws, with Carbon Spider and Sprite Spider gangs exploiting the flaws to encrypt virtual machines (VMs).
-
What might cause the 'AI bubble' to burst?In-depth If a bubble is really forming, what happens to the businesses caught up in the AI craze when it pops – and why things might not be as bad as they seem
-
London set to host OpenAI's largest research hub outside USNews OpenAI wants to capitalize on the UK’s “world-class” talent in areas such as machine learning
-
Security agencies issue warning over critical Cisco Catalyst SD-WAN vulnerabilityNews Threat actors have been exploiting the vulnerability to achieve root access since 2023
-
Millions of developers could be impacted by flaws in Visual Studio Code extensions – here's what you need to know and how to protect yourselfNews The VS Code vulnerabilities highlight broader IDE security risks, said OX Security
-
CVEs are set to top 50,000 this year, marking a record high – here’s how CISOs and security teams can prepare for a looming onslaughtNews While the CVE figures might be daunting, they won't all be relevant to your organization
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
Experts welcome EU-led alternative to MITRE's vulnerability tracking schemeNews The EU-led framework will reduce reliance on US-based MITRE vulnerability reporting database
-
Veeam patches Backup & Replication vulnerabilities, urges users to updateNews The vulnerabilities affect Veeam Backup & Replication 13.0.1.180 and all earlier version 13 builds – but not previous versions.
-
Two Fortinet vulnerabilities are being exploited in the wild – patch nowNews Arctic Wolf and Rapid7 said security teams should act immediately to mitigate the Fortinet vulnerabilities
-
Everything you need to know about Google and Apple’s emergency zero-day patchesNews A serious zero-day bug was spotted in Chrome systems that impacts Apple users too, forcing both companies to issue emergency patches
