Multiple vulnerabilities have been discovered in VMware vCenter Server and Cloud Foundation, the most severe of which could allow for remote code execution. VMware vCenter Server is the centralized management utility for VMware. VMware Cloud Foundation is a multi-cloud platform that provides a full-stack hyperconverged infrastructure (HCI) that is made for modernizing data centers and deploying modern container-based applications. Successful exploitation of these vulnerabilities could allow for remote code execution in the
context of the administrator account. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Systems Affected

• VMware vCenter Server versions prior to 8.0U2
• VMware vCenter Server versions prior to 8.0U1d
• VMware vCenter Server versions prior to 7.0U3o
• VMware Cloud Foundation (VMware vCenter Server) versions prior to KB88287

Risk

1. Government:
   – Large and medium government entities: High
   – Small government entities: Medium
2. Businesses:
   – Large and medium business entities: High
   – Small business entities: Medium
3. Home Users: Low

Recommendations

• Apply appropriate updates provided by VMware to vulnerable systems immediately
  after appropriate testing.
• Apply the Principle of Least Privilege to all systems and services. Run all software as a
  non-privileged user (one without administrative privileges) to diminish the effects of a
  successful attack.
• Prevent access to file shares, remote access to systems, unnecessary services.
  Mechanisms to limit access may include use of network concentrators, RDP gateways,
  etc.
• Use intrusion detection signatures to block traffic at network boundaries.
• Use capabilities to detect and block conditions that may lead to or be indicative of a
  software exploit occurring.

Reporting

The NJCCIC encourages recipients who discover signs of malicious cyber activity to contact the NJCCIC via the cyber incident report form at www.cyber.nj.gov/report.

Please do not hesitate to contact us here at Cyber Command with any questions.