Maximize your protection, eliminate business risks.
Optimize and modernize with cloud transformation.
Empower your people to work securely from anywhere.
Let us handle IT so you can focus on growing your business.
Get multichannel 24/7/365 expert end-user support.
Stay ahead of attacks with 24/7 protection and monitoring.
Maximize uptime with with industry-leading DRaaS.
Improve efficiency, productivity and outcomes with cloud.
Ensure all mobile devices, everywhere, are secure.
Gain a competitive edge with strategic IT solutions.
This battle-tested checklist enables your team to swiftly initiate a ransomware response.
IT for businesses of all sizes, in any industry.
Empower institution growth with custom IT solutions.
Ensure your firm is always in compliance.
Improve patient care and staff morale.
Deal with pressing legal matters, not IT.
Keep up with the evolving digital landscape.
Focus on your mission by outsourcing IT.
Accelerate PE client deals and secure data.
Leverage your technology as a strategic asset.
Execute initiatives and develop IT strategies.
Get the latest industry insights and trends.
Join us at events in person and online.
Hear from clients and learn more about strategic IT.
See how Dataprise can make IT your greatest asset.
Get informative technical resources from IT experts.
Stay on stop of emerging cybersecurity threats.
Discover the key areas of DR your organization needs to address to ensure downtime is minimized.
Gain a strategic asset by bringing harmony to IT.
Ensure 24/7 support and security with dedicated teams.
Drive business forward by partnering with Dataprise.
Meet our one-of-a-kind leadership team.
Discover the recognition Dataprise has earned.
Help us help businesses with strategic IT.
Embracing different perspectives and backgrounds.
Find a Dataprise location near you.
Dataprise is committed to empowering more women to consider a career in technology.
Defense Digests
Table of content
Dataprise Defense Digest
ID: D3-2023-0009-1
Published October 26. 2023
Severity: 9.8/10
On October 24, 2023, VMware released security advisory VMSA-2023-0023 to address an out of bounds write vulnerability in their implementation of the DCE/RPC protocol. This vulnerability is tracked as CVE-2023-34048 with a CVSS score of 9.8 out of 10. This vulnerability can potentially lead to Remote Code Execution (RCE) if a threat actor has network access to the vCenter server. VMware has released updates fixing this issue and there are no known workarounds without updating.
Additionally, VMware has included with this update a patch for CVE-2023-34056, an information disclosure vulnerability which had been partially remediated by September’s updates. According to VMware, this vulnerability could allow a non-administrative user to obtain unauthorized data/information from the vCenter server. This has been rated with a CVSS score of 4.3 out of 10.
Dataprise is aware of the critical nature of this vulnerability and is conducting a review of all available analyses of these vulnerabilities and the potential impact on our clients. This has been a major exercise as the investigation requires that a specific order of actions is taken to achieve the response objectives. Right now, our teams are working to confirm whether the recommended mitigation steps can be applied without causing any customerfacing service interruptions. If your organization’s VMWare vCenter is covered under a Dataprise Managed Service agreement, we will send a follow-up communication with details on our mitigation efforts.
Due to the large scope of affected machines and the critical nature of RCEs, VMware has not released details of how this RCE is achieved through the vulnerability. They have released patches to older end-of-life versions of vSphere but strongly recommend upgrading to at least 7.0U3o, ideally 8.0U2.
If patching needs to be scheduled, reviewing and restricting network access to the vCenter server would be a good measure to minimize the attack surface. It is especially important to prevent the server from being accessible over WAN. Ideally only a maintenance server would be able to administer the vCenter server over LAN.
INSIGHTS
Subscribe to get real-time notifications when a new Dataprise Defense Digest is published.