CVE-2024-37079
Description
vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter Server may trigger this vulnerability by sending a specially crafted network packet potentially leading to remote code execution.
Summary dbcve.org
vCenter Server contains a heap-overflow vulnerability in its DCERPC protocol implementation. An unauthenticated remote attacker with network access can send specially crafted packets to trigger the overflow, potentially achieving remote code execution with high privileges on the underlying system.
Mitigation
Apply the applicable VMware/Broadcom security patch for CVE-2024-37079 as soon as possible. As an interim measure, restrict network access to vCenter Server management interfaces to minimize exposure.