CVE-2024-37079

Description

vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.

References

https://thehackernews.com/2024/09/patch-issued-for-critical-vmware.html

https://www.bleepingcomputer.com/news/security/broadcom-fixes-critical-rce-bug-in-vmware-vcenter-server/

https://www.thezdi.com/blog/2024/8/27/cve-2024-37079-vmware-vcenter-server-integer-underflow-code-execution-vulnerability

https://www.helpnetsecurity.com/2024/06/18/cve-2024-37079-cve-2024-37080/

https://thehackernews.com/2024/06/vmware-issues-patches-for-cloud.html

https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/24453

https://cloud.google.com/support/bulletins/index#gcp-2024-037

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3