Advisory No: TZCERT/SA/2021/05/27

Date of First Release: 27^th May 2021

Source: VMware 

Software Affected: 

• VMware vCenter Server (vCenter Server)
• VMware Cloud Foundation (Cloud Foundation)

Overview:

Multiple vulnerabilities exist in vSphere Client (HTML5) that could cause remote code execution (CVE-2021-21985) and perform actions allowed by Virtual SAN Health Check plug-in without authentication (CVE-2021-21986).

Description:

The vSphere Client (HTML5) contains a remote code execution (CVE-2021-21985) vulnerability due to lack of input validation in the Virtual SAN Health Check plug-in enabled in the vCenter server by default.

Similarly, the client contains another authentication vulnerability (CVE-2021-21986) for the Virtual SAN Health Check, Site Recovery, vSphere Lifecycle Manager, and VMware Cloud Director Availability plug-ins that could allow an attacker to bypass authentication and perform actions supported by the plug-ins.

Impact:

Successful exploitation of these vulnerabilities could lead to remote code execution and authentication bypass on the affected system.

Solution:

VMware has issued both security updates to address the affected products. Users and administrators are advised to apply necessary updates (Vcenter server (7.0 U2b, 6.7 U3n, 6.5 U3p), Cloud Foundation ( 4.2.1 and .10.2.1)) on affected products.

References:

1. https://kb.vmware.com/s/article/83829
2. https://www.vmware.com/security/advisories/VMSA-2021-0010.html

Google has released security updates to address vulnerabilities in Chrome prior to version 91.0.4472.77. Exploitation of these vulnerabilities may allow an attacker to take control of affected system.

Users and administrators are encouraged to review Chrome Release Note and apply necessary updates.

VMware has released security updates to address vulnerabilities in VMware vCenter Server and VMware Cloud Foundation. Exploitation of these vulnerabilities may allow an attacker to take control of affected system.

Users and administrators are encouraged to review VMware Security Advisory and apply necessary updates.

Hewlett Packard Enterprise has released security updates to address a vulnerability in HPE 3PAR and Primera SSMC. Exploitation of this vulnerability may allow an attacker to take control of affected system.

Users and administrators are encouraged to review HP Security Advisory and apply necessary updates.

Arch Linux has released security updates to address vulnerabilities in multiple products. Exploitation of these vulnerabilities may allow an attacker to take control of affected system.

Users and administrators are encouraged to review Arch Linux Security Advisories and apply necessary updates.