www.scmagazine.com
Open in
urlscan Pro
2606:4700:20::681a:d13
Public Scan
URL:
https://www.scmagazine.com/news/cloud-security/vmware-discloses-trio-of-high-severity-bugs-in-network-monitoring-tool
Submission: On June 08 via api from TR — Scanned from DE
Submission: On June 08 via api from TR — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="w-100" scmag-registration="set">
<div class="my-2 font-sans"><label class="visually-hidden form-label" for="email">Business Email</label><input placeholder="Business Email*" required="" type="email" id="email" class="fs-7 text-black p-3 form-control" value=""></div>
<div class="fs-9 my-4">
<p>By clicking the Subscribe button below, you agree to SC Media <a class="text-underline" href="/terms-and-conditions" data-feathr-click-track="true" data-feathr-link-aids="["60071024bdb3f8d0470da8d6"]">Terms and Conditions</a><span>
and </span><a class="text-underline" href="/privacy-policy" data-feathr-click-track="true" data-feathr-link-aids="["60071024bdb3f8d0470da8d6"]">Privacy Policy</a>.</p>
</div><button type="submit" class="btn btn-primary">Subscribe</button>
</form>Text Content
Log inRegister Topics Events Podcasts Research Recognition Leadership About CRA ADVERTISEMENT Cloud security, Network security VMWARE DISCLOSES TRIO OF HIGH SEVERITY BUGS IN NETWORK MONITORING TOOL Derek B. JohnsonJune 7, 2023 While CVE numbers have been assigned to each bug, they contain little to no information on when they were first discovered or whether they have already been exploited in the wild. (Photo by Yichuan Cao/NurPhoto via Getty Images) Cloud computing and virtualization company VMware disclosed a trio of high-severity vulnerabilities affecting their network monitoring tool, Aria Operations for Networks. According to the company, one bug (CVE 2023-20887) is a command injection vulnerability with a CVSS severity score of 9.8 that allows an attacker to remotely execute code. The second, an authentication deserialization bug (CVE 2023-20888), comes with a severity score of 9.1 and also allows for remote code execution. The third (CVE 2023-20889), rated at 8.8, allows for command injection attacks that can lead to information disclosure. All three attack vectors require existing network access to Aria Operations for Networks to exploit. According to VMware, the tool is used to provide “network visibility and analytics to accelerate micro-segmentation security, minimize risk during application migration, optimize network performance and confidently manage and scale VMware NSX, VMware SD-WAN, and Kubernetes deployments.” ADVERTISEMENT Further technical details around all three vulnerabilities are scarce. While CVE numbers have been assigned to each bug, they contain little information. A customer connect page for VMware indicates versions 6.2, 6.3, 6.4, .6.51, 6.6, 6.7, 6.8, 6.9 and 6.10 of the tool are vulnerable to attack. Patches exist for all three vulnerabilities, and VMWare has stated there are currently no other workarounds or remediating actions available. In a statement, a VMware spokesperson told SC Media they have no evidence that any of the bugs have been used by malicious hackers. “VMware is not aware of any exploits in the wild at this time for CVE-2023-20887, CVE-2023-20888, or CVE-2023-20889, and the security advisory we released this morning provides the patches that customers can apply to resolve the vulnerabilities," the spokesperson said. :The security of our customers is a top priority, and we encourage them to apply the patches in a timely manner to protect their environment.” Two of the bugs were discovered by security researcher Sina Kheirkhah of Summoning Team, while the other was reported by an anonymous researcher. All three were discovered as part of Trend Micro’s Zero Day Initiative. SC Media has reached out to Trend Micro for further information. Derek B. Johnson Derek is a senior editor and reporter at SC Media, where he has spent the past three years providing award-winning coverage of cybersecurity news across the public and private sectors. Prior to that, he was a senior reporter covering cybersecurity policy at Federal Computer Week. Derek has a bachelor’s degree in print journalism from Hofstra University in New York and a master’s degree in public policy from George Mason University in Virginia. RELATED Cloud security BAD GUYS NO LONGER: HERE’S HOW TO KEEP DATA SECURE WITHOUT RESTRICTING SAAS APPS Rich Vibert June 7, 2023 CISOs often prohibit or limit the use of SaaS apps for security reasons, but there are other ways to safeguard sensitive data without saying no to all cloud apps. Cloud security CROWDSTRIKES CHARLOTTE AI CYBERSECURITY CHATBOT LAUNCHES SC StaffJune 6, 2023 CrowdStrike has launched a new generative AI chatbot called Charlotte AI as part of new integrations to help users address cybersecurity incidents more effectively, SiliconANGLE reports. Cloud security GOOGLE LAUNCHES SECURE MULTI-CLOUD NETWORKING SERVICES SC StaffJune 6, 2023 Google has announced the general availability of Cross-Cloud Interconnect and Private Service Connect, two new services that allow enterprises to run applications securely and efficiently on multiple cloud environments, according to SDxCentral. RELATED EVENTS * Cybercast SAAS DATA BACKUPS: AUTOMATED RESILIENCE & RECOVERY IN THE CLOUD On-Demand Event * Cybercast MODERN PRIVILEGED ACCESS MANAGEMENT IN THE CLOUD: WHAT’S IN, WHAT’S OUT? On-Demand Event * Cybercast TACKLING THE UNIQUE CHALLENGES OF KUBERNETES & CONTAINER SECURITY On-Demand Event ADVERTISEMENT GET DAILY EMAIL UPDATES SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms and Conditions and Privacy Policy. Subscribe ADVERTISEMENT ADVERTISEMENT X -------------------------------------------------------------------------------- ABOUT US SC MediaCyberRisk AllianceContact UsCareersPrivacy GET INVOLVED SubscribeContribute/SpeakAttend an eventJoin a peer groupPartner With Us EXPLORE Product reviewsResearchWhite papersWebcastsPodcasts Copyright © 2023 CyberRisk Alliance, LLC All Rights Reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorization. Your use of this website constitutes acceptance of CyberRisk Alliance Privacy Policy and Terms & Conditions. COOKIES This website uses cookies to improve your experience, provide social media features and deliver advertising offers that are relevant to you. If you continue without changing your settings, you consent to our use of cookies in accordance with our privacy policy. You may disable cookies. Accept cookies