Critical Vuln in vCenter vmdir (CVE-2020-3952)

Watch ISC TV. Great for NOCs, SOCs and Living Rooms: https://isctv.sans.edu

Handler on Duty: Didier Stevens

Threat Level: green

Critical Vuln in vCenter vmdir (CVE-2020-3952)
On April 9, VMware published VMSA-2020-0006, a security advisory for a critical vulnerability in vCenter Server that received the maximum CVSSv3 score of 10.0. The vulnerablity, CVE-2020-3952 , involves a sensitive information disclosure flaw in the VMware Directory Service (vmdir) which is included with VMware vCenter. Per the advisory, vmdir does not implement proper access controls, which could allow a malicious attacker with network access to obtain sensitive information. This likely can allow the attacker to compromise other services which rely on vmdir for authentication. We recommend reviewing the security advisory and related KB article and determine if it is applicable for organizations utilizing vCenter and take action as soon as possible to limit exposure. https://www.vmware.com/security/advisories/VMSA-2020-0006.html https://kb.vmware.com/s/article/78543 --- Scott ISC Handler	ScottF 191 Posts ISC Handler Apr 10th 2020
Thread locked Subscribe	Apr 10th 2020 2 years ago