www.vmware.com Open in urlscan Pro
2a02:26f0:480:497::2ef  Public Scan

Form analysis
3 forms found in the DOM

//www.vmware.com/search.html

<form action="//www.vmware.com/search.html" id="globalsearch" class="wrapperSearch">
  <input type="text" name="q" id="ub-search" class="d-none" placeholder="Search" title="Search" aria-role="searchbox" role="searchbox">
  <a href="javascript:void(0);" aria-label="Search vmware.com" class="search-icon ml-lg-3" name="nav_utility : Search">

									<i class="fa fa-search text-indigo mr-2 mr-lg-0" aria-hidden="true"></i>
								 </a>
  <input type="hidden" name="num" value="20">
  <input type="hidden" name="filter" value="0">
  <input type="hidden" name="ie" value="UTF-8">
  <input type="hidden" name="oe" value="UTF-8">
  <input type="hidden" name="entqr" value="0">
  <input type="hidden" name="start" value="0">
  <input type="hidden" name="sort" value="">
  <input type="hidden" name="tlen" value="200">
  <input type="hidden" name="numgm" value="3">
  <input type="hidden" name="cn" value="vmware">
  <input type="hidden" name="cid" value="">
  <input type="hidden" name="tid" value="">
  <input type="hidden" name="getfields" value="*">
  <input type="hidden" name="partialfields" value="">
  <input type="hidden" name="requiredfields" value="">
  <input type="hidden" name="place" value="top">
  <input type="hidden" name="client" value="VMware_Site_1">
  <input type="hidden" name="site" value="VMware_Site_1">
  <input type="hidden" name="cc" value="en">
  <input type="hidden" name="stype" value="main">
</form>

//www.vmware.com/search.html

<form action="//www.vmware.com/search.html" id="globalsearch" class="wrapperSearch">
  <a href="javascript:void(0);" tabindex="-1" class="search-icon ml-lg-3" name="nav_utility : Search">
      </a>
  <input type="text" name="q" id="ub-search" placeholder="Search" title="Search" role="searchbox">
  <input type="hidden" name="num" value="20">
  <input type="hidden" name="filter" value="0">
  <input type="hidden" name="ie" value="UTF-8">
  <input type="hidden" name="oe" value="UTF-8">
  <input type="hidden" name="entqr" value="0">
  <input type="hidden" name="start" value="0">
  <input type="hidden" name="sort" value="">
  <input type="hidden" name="tlen" value="200">
  <input type="hidden" name="numgm" value="3">
  <input type="hidden" name="cn" value="vmware">
  <input type="hidden" name="cid" value="">
  <input type="hidden" name="tid" value="">
  <input type="hidden" name="getfields" value="*">
  <input type="hidden" name="partialfields" value="">
  <input type="hidden" name="requiredfields" value="">
  <input type="hidden" name="place" value="top">
  <input type="hidden" name="client" value="VMware_Site_1">
  <input type="hidden" name="site" value="VMware_Site_1">
  <input type="hidden" name="cc" value="en">
  <input type="hidden" name="stype" value="main">
</form>

Name: securitysignup —

<form accept-charset="UNKNOWN" id="securitysignup" name="securitysignup" data-gtm-form-interact-id="0">
  <label class="email-input-label" for="securityEmail">*Email</label>
  <input id="securityEmail" name="email" size="25" type="text" data-gtm-form-interact-field-id="0">
  <span class="subscriptionerrorMsg sa-validation-alerts" tabindex="0"></span>
  <input name="email-button" class="sa-subscription-modal-button sa-subscription-submit-button" type="submit" onclick="s_objectID='content_advisories :  : 0';" value="Submit">
</form>

Text Content

Skip to Promo Skip to main content
Global Search

US Store
Login
Cloud Services Console Customer Connect Partner Connect
 * Multi-Cloud Services
 * Products
 * Solutions
 * Partners
 * Resources

GET STARTED
Global Search

Main Menu

TODAY’S MULTI-CLOUD REALITY: CLOUD CHAOS

87% OF ENTERPRISES USE TWO OR MORE CLOUD ENVIRONMENTS TO RUN THEIR APPLICATIONS.
MULTI-CLOUD ACCELERATES DIGITAL TRANSFORMATION, BUT ALSO INTRODUCES COMPLEXITY
AND RISK, RESULTING IN A CHAOTIC REALITY FOR MANY ORGANIZATIONS.

LEARN ABOUT MULTI-CLOUD

CONQUER CLOUD CHAOS WITH VMWARE CROSS-CLOUD SERVICES



VMware is addressing cloud chaos with our portfolio of multi-cloud services,
VMware Cross-Cloud services, which enable you to build, run, manage, secure, and
access applications consistently across cloud environments.

With VMware Cross-Cloud services, you can address cloud chaos and shift to a
cloud smart approach – one where you can choose the best environment for every
application, without multiplying your complexity.


LEARN HOW CROSS-CLOUD SERVICES CAN HELP

Main Menu

ANYWHERE WORKSPACE

Access Any App on Any Device Securely

Horizon Horizon Cloud Workspace ONE Workspace ONE UEM

APP PLATFORM

Build and Operate Cloud Native Apps

Tanzu

CLOUD & EDGE INFRASTRUCTURE

Run Enterprise Apps Anywhere

Cloud Foundation/Cloud Foundation+ SD-WAN/SASE Telco Cloud vSAN/vSAN+
vSphere/vSphere+ VMware Cloud VMware Cloud Disaster Recovery

CLOUD MANAGEMENT

Automate and Optimize Apps and Clouds

VMware Aria CloudHealth Skyline

DESKTOP HYPERVISOR

Manage apps in a local virtualization sandbox

Fusion for Mac Workstation Player Workstation Pro

SECURITY & NETWORKING

Connect and Secure Apps and Clouds

Carbon Black Cloud Carbon Black Endpoint NSX/NSX+ NSX Advanced Load Balancer NSX
Distributed Firewall

RUN VMWARE ON ANY CLOUD. ANY ENVIRONMENT. ANYWHERE.

ON PUBLIC & HYBRID CLOUDS

Alibaba Cloud VMware Service Azure VMware Solution Google Cloud VMware Engine
IBM Cloud for VMware Solutions Oracle Cloud VMware Solutions VMware Cloud on AWS
VMware Cloud on AWS GovCloud (US)

ON PRIVATE & LOCAL CLOUDS

Dell EMC VxRail VMware Cloud on Equinix Metal VMware on AWS Outposts VMware
Verified Cloud Providers

SEE ALL PRODUCTS SEE PRICING
SaaS (Subscription) product version available
Main Menu

SOLUTIONS

ANYWHERE WORKSPACE

ACCESS ANY APP ON ANY DEVICE SECURELY

APP PLATFORM

BUILD AND OPERATE CLOUD NATIVE APPS

CLOUD INFRASTRUCTURE

RUN ENTERPRISE APPS ANYWHERE

CLOUD MANAGEMENT

AUTOMATE AND OPTIMIZE APPS AND CLOUDS

EDGE INFRASTRUCTURE

ENABLE THE MULTI-CLOUD EDGE

NETWORKING

ENABLE CONNECTIVITY FOR APPS AND CLOUDS

SECURITY

SECURE APPS AND CLOUDS

BY INDUSTRY

Communications Service Providers Department of Defense Federal Government
Financial Services Healthcare Providers State and Local Government

VMWARE AI SOLUTIONS

Accelerate and ensure the success of your generative AI initiatives with
multi-cloud flexibility, choice, privacy and control.

LEARN MORE

SEE ALL SOLUTIONS SEE ALL INDUSTRIES
Main Menu

FOR CUSTOMERS

Find a Cloud Provider Find a Partner VMware Marketplace Work with a Partner

FOR PARTNERS

Become a Cloud Provider Cloud Partner Navigator Get Cloud Verified Learning and
Selling Resources Partner Connect Login Partner Executive Edge Technology
Partner Hub Work with VMware

WORKING TOGETHER WITH PARTNERS FOR CUSTOMER SUCCESS

See how we work with a global partner to help companies prepare for multi-cloud.

VIEW PARTNER STORY

Main Menu

TOOLS & TRAINING

VMware Customer Connect VMware Trust Center Learning & Certification Tech Zone
Product Downloads Product Trials Cloud Services Engagement Platform Hands-on
Labs

SERVICES

Professional Services Customer Success

SUPPORT

VMware Customer Connect Support Offerings Skyline Support Customer Welcome
Center

MARKETPLACE

Cloud Marketplace VMware Marketplace

VIDEOS

VMware Video Library VMware Explore Video Library

BLOGS & COMMUNITIES

Blogs Podcasts News & Stories Communities

CUSTOMERS

Customer Stories

EVENTS

VMware Explore SpringOne All Events & Webcasts

SEE ALL RESOURCES
Ellipsis
VMware Security Solutions  Advisories  VMSA-2023-0023



Critical

Advisory ID: VMSA-2023-0023
CVSSv3 Range: 4.3-9.8
Issue Date: 2023-10-25
Updated On: 2023-10-25 (Initial Advisory)
CVE(s): CVE-2023-34048, CVE-2023-34056
Synopsis: VMware vCenter Server updates address out-of-bounds write and
information disclosure vulnerabilities (CVE-2023-34048, CVE-2023-34056)

RSS Feed

Download PDF

Download Text File

Share this page on social media:



Sign up for Security Advisories

SIGN UP FOR SECURITY ADVISORIES

Stay up to date on the latest VMware Security advisories and updates.





Close
*Email

1. IMPACTED PRODUCTS

 * VMware vCenter Server
 * VMware Cloud Foundation

2. INTRODUCTION

An out-of-bounds write (CVE-2023-34048) and a partial information disclosure
(CVE-2023-34056) in vCenter Server were responsibly reported to VMware. Updates
are available to remediate these vulnerabilities in affected VMware products.

3A. VMWARE VCENTER SERVER OUT-OF-BOUNDS WRITE VULNERABILITY (CVE-2023-34048)

Description

vCenter Server contains an out-of-bounds write vulnerability in the
implementation of the DCERPC protocol. VMware has evaluated the severity of this
issue to be in the Critical severity range with a maximum CVSSv3 base score of
9.8.

Known Attack Vectors

A malicious actor with network access to vCenter Server may trigger an
out-of-bounds write potentially leading to remote code execution.

Resolution

To remediate CVE-2023-34048 apply the updates listed in the 'Fixed Version'
column of the 'Response Matrix' below to affected deployments.

Workarounds

In-product workarounds were investigated, but were determined to not be viable.

Additional Documentation

A supplemental FAQ was created for additional clarification. Please see:
https://via.vmw.com/vmsa-2023-0023-qna

Notes

 * While VMware does not mention end-of-life products in VMware Security
   Advisories, due to the critical severity of this vulnerability and lack of
   workaround VMware has made a patch generally available for vCenter Server
   6.7U3, 6.5U3, and VCF 3.x. For the same reasons, VMware has made additional
   patches available for vCenter Server 8.0U1.
 * Async vCenter Server patches for VCF 5.x and 4.x deployments have been made
   available. Please see KB88287 for more information.

Acknowledgements

VMware would like to thank Grigory Dorodnov of Trend Micro Zero Day
Initiative for reporting this issue to us.

3B. VMWARE VCENTER SERVER PARTIAL INFORMATION DISCLOSURE VULNERABILITY
(CVE-2023-34056)

Description

vCenter Server contains a partial information disclosure vulnerability. VMware
has evaluated the severity of this issue to be in the Moderate severity range
with a maximum CVSSv3 base score of 4.3.

Known Attack Vectors

A malicious actor with non-administrative privileges to vCenter Server may
leverage this issue to access unauthorized data.

Resolution

To remediate CVE-2023-34056 apply the updates listed in the 'Fixed Version'
column of the 'Response Matrix' below to affected deployments.

Workarounds

None.

Additional Documentation

None.

Acknowledgements

VMware would like to thank Oleg Moshkov of Deiteriy Lab OÜ for reporting this
issue to us.

Response Matrix

Product Version Running On CVE Identifier CVSSv3 Severity Fixed Version
Workarounds Additional Documentation
VMware vCenter Server
8.0
Any
CVE-2023-34048, CVE-2023-34056
9.8, 4.3
critical
8.0U2
None
FAQ
VMware vCenter Server
8.0
Any
CVE-2023-34048
9.8
critical
8.0U1d
None
FAQ
VMware vCenter Server
7.0
Any
CVE-2023-34048, CVE-2023-34056
9.8, 4.3
critical
7.0U3o
None
FAQ
VMware Cloud Foundation (VMware vCenter Server)
5.x, 4.x
Any
CVE-2023-34048, CVE-2023-34056
9.8, 4.3
critical
KB88287
None
FAQ

4. REFERENCES

Fixed Version(s) and Release Notes:

VMware vCenter Server 8.0U2
Downloads and Documentation:
https://customerconnect.vmware.com/downloads/details?downloadGroup=VC80U2&productId=1345&rPId=110105

VMware vCenter Server 8.0U1d
Downloads and Documentation:
https://customerconnect.vmware.com/downloads/details?downloadGroup=VC80U1D&productId=1345&rPId=112378

VMware vCenter Server 7.0U3o
Downloads and Documentation:
https://customerconnect.vmware.com/downloads/details?downloadGroup=VC70U3O&productId=974&rPId=110262

Cloud Foundation 5.x/4.x
https://kb.vmware.com/s/article/88287

Mitre CVE Dictionary Links
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34048
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-34056


FIRST CVSSv3 Calculator
CVE-2023-34048:
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2023-34056:
https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

5. CHANGE LOG

2023-10-25 VMSA-2023-0023
Initial security advisory.

6. CONTACT

E-mail: security@vmware.com

PGP key at:
https://kb.vmware.com/kb/1055 

VMware Security Advisories
https://www.vmware.com/security/advisories 

VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html 

VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html 

VMware Security & Compliance Blog  
https://blogs.vmware.com/security 

Twitter
https://twitter.com/VMwareSRC


Copyright 2023 VMware Inc. All rights reserved.
 


Company

About Us Executive Leadership News & Stories Investor Relations Customer Stories
Diversity, Equity & Inclusion Environment, Social & Governance AI at VMware
Careers Blogs Communities Acquisitions Office Locations VMware Cloud Trust
Center COVID-19 Resources

Support

VMware Customer Connect Support Policies Product Documentation Compatibility
Guide Terms & Conditions California Transparency Act Statement Hands-on Labs &
Trials
Twitter YouTube Facebook LinkedIn Contact Sales

--------------------------------------------------------------------------------

© 2023 VMware, Inc. Terms of Use Your California Privacy Rights Privacy
Accessibility Trademarks Glossary Help
Cookies Settings





WE CARE ABOUT YOUR PRIVACY

We use cookies to provide you with the best experience on our website, to
improve usability and performance and thereby improve what we offer to you. Our
website may also use third-party cookies to display advertising that is more
relevant to you. By clicking on the “Accept All” button you agree to the storing
of cookies on your device. If you close the cookie banner, only strictly
necessary cookies will be stored on your device. If you want to know more about
how we use cookies, please see our Cookie Policy.
Cookies Settings Accept All Cookies



COOKIE PREFERENCE CENTER




 * GENERAL INFORMATION ON COOKIES


 * STRICTLY NECESSARY


 * PERFORMANCE


 * FUNCTIONAL


 * ADVERTISING

GENERAL INFORMATION ON COOKIES

When you visit our website, we use cookies to ensure that we give you the best
experience. This information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies by clicking on the
different category headings to find out more and change your settings. However,
blocking some types of cookies may impact your experience on the site and the
services we are able to offer. Further information can be found in our
Cookie Policy.

STRICTLY NECESSARY

Always Active

Strictly necessary cookies are always enabled since they are essential for our
website to function. They enable core functionality such as security, network
management, and website accessibility. You can set your browser to block or
alert you about these cookies, but this may affect how the website functions.
For more information please visit www.aboutcookies.org or
www.allaboutcookies.org.

Cookies Details‎

PERFORMANCE

Performance


Performance cookies are used to analyze the user experience to improve our
website by collecting and reporting information on how you use it. They allow us
to know which pages are the most and least popular, see how visitors move around
the site, optimize our website and make it easier to navigate.

Cookies Details‎

FUNCTIONAL

Functional


Functional cookies help us keep track of your past browsing choices so we can
improve usability and customize your experience. These cookies enable the
website to remember your preferred settings, language preferences, location and
other customizable elements such as font or text size. If you do not allow these
cookies, then some or all of these services may not function properly.

Cookies Details‎

ADVERTISING

Advertising


Advertising cookies are used to send you relevant advertising and promotional
information. They may be set through our site by third parties to build a
profile of your interests and show you relevant advertisements on other sites.
These cookies do not directly store personal information, but their function is
based on uniquely identifying your browser and internet device.

Cookies Details‎
Back Button


COOKIE LIST

Filter Button
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Clear
checkbox label label
Apply Cancel
Confirm My Choices
Reject All Allow All