Security Bulletin: Vulnerabilities in VMware affect IBM Cloud Pak System [CVE-2023-34048, CVE-2023-34056]

Summary

Vulnerabilities in VMware vCenter affect IBM Cloud Pak System. This bulletin identifies the steps to take to address the vulnerability.

Vulnerability Details

CVEID:CVE-2023-34048
**DESCRIPTION:**VMware vCenter Server and Cloud Foundation could allow a remote attacker to execute arbitrary code on the system, caused by an out-of-bounds write flaw. By sending a specially crafted request, an attacker could exploit this vulnerability to execute arbitrary code on the system.
CVSS Base score: 9.8
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/269446 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID:CVE-2023-34056
**DESCRIPTION:**VMware vCenter Server and Cloud Foundation could allow a remote authenticated attacker to obtain sensitive information, caused by improper authorization validation. By sending a specially crafted request, an attacker could exploit this vulnerability to obtain sensitive information, and use this information to launch further attacks against the affected system.
CVSS Base score: 4.3
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/269447 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)

Affected Products and Versions

Remediation/Fixes

Critical code execution vulnerabilities have been found in VMWare vCenter. In response to these vulnerabilities Cloud Pak System provides a new vCenter Image update to vCenter Windows version 6.7.0 U3t with Cloud Pak System 2.3.3.6 Interim Fix 2.

IBM strongly recommends addressing the vulnerability now by upgrading to IBM Cloud Pak System v2.3.3.6 Interim Fix2.

For IBM Cloud Pak System v2.3.3.0 through v2.3.3.6
upgrade to Cloud Pak System 2.3.3.6. Ifix1, apply IBM Cloud Pak System v2.3.3.6 Interim Fix 2 at Fix Central.

information on upgrading here <https://www.ibm.com/support/pages/node/7017280&gt;

For IBM Cloud Pak System V2.3.3.6 Interim Fix1,
Apply Cloud Pak System V2.3.3.6 Interim Fix 2 at Fix Central
information on upgrading available at <http://www.ibm.com/support/docview.wss?uid=ibm10887959&gt;

Workarounds and Mitigations

None