This report is about a vulnerability found in the VMWare vCenter software known as CVE-2020-3952. The vulnerability is caused by improper access controls affecting the VMware Directory Service. The affected version of the software is vCenter 6.7 with a patch available for this software flaw.
The root cause of this vulnerability is the improper implementation of access controls allowing a bad actor to extract highly sensitive information from the VMware Directory Service (vmdir). When this software flaw is successfully exploited, a bad actor with network access can target the authentication mechanisms within vCenter. The vulnerability affects both the vCenter Server Appliance and the vCenter Server on Windows. This software flaw only exists in vCenter version 6.7 and can be fixed by applying patch 6.7u3f or upgrading to version 7.0.
The vulnerability only affects deployments where an in-place upgrade was used instead of a clean install of version 6.7.
This CVE-2020-3952 vulnerability could result in the loss of sensitive information which may lead to the compromise of a critical asset. There’s a strong possibility that a bad actor may be able to bypass the authentication mechanisms of the vCenter Server and gain full control of the affected host.
If control is lost, the bad actor could make changes to the host and extract valuable data from the virtual machines residing on the deployment.
It’s highly encouraged that you implement the vendor patch linked below to eliminate the CVE-2020-3952 vCenter Software Vulnerability. You should:
IBM X-Force Exchange:
Note: The Avertium Threat Report analyzes one current threat that has been shared by threat intelligence networks across the globe. Used internally by the Avertium CyberOps Team, this report outlines a “top-of-mind” threat and how it ought to be addressed accordingly.
This informed analysis is based on the latest data available.
Contact us for more information about Avertium’s managed detection and response service capabilities.