CVE-2024-37079

Description

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

References

https://www.bleepingcomputer.com/news/security/critical-rce-bug-in-vmware-vcenter-server-now-exploited-in-attacks/

https://securityaffairs.com/171147/security/vmware-vcenter-server-bugs-actively-exploited.html

https://thehackernews.com/2024/09/patch-issued-for-critical-vmware.html

https://www.bleepingcomputer.com/news/security/broadcom-fixes-critical-rce-bug-in-vmware-vcenter-server/

https://www.thezdi.com/blog/2024/8/27/cve-2024-37079-vmware-vcenter-server-integer-underflow-code-execution-vulnerability

https://www.helpnetsecurity.com/2024/06/18/cve-2024-37079-cve-2024-37080/

https://thehackernews.com/2024/06/vmware-issues-patches-for-cloud.html

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453

https://cloud.google.com/support/bulletins/index#gcp-2024-037

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3