ZeroDay Findings
Sign inSign up

Every 4 hours

Cyber

Original briefings from the security press, rewritten for operators. Each story keeps the date of the report it is based on, links the identifiers it discusses, and points back to the original publication.

Threat intelligence

Trackers and reporting desks followed on the same four-hour update. New public reports are rewritten into the briefings below.

PrioritySourceWebsiteInformation
Ransomware.liveWebsiteRansomware.liveInformationRansomware groups, victims, incidents
The DFIR ReportWebsiteThe DFIR ReportInformationDetailed intrusion investigations
SANS Internet Storm CenterWebsiteSANS ISCInformationAttack observations and incident analysis
abuse.ch ThreatFoxWebsiteThreatFoxInformationIndicators of compromise
abuse.ch URLhausWebsiteURLhausInformationMalware distribution infrastructure
abuse.ch MalwareBazaarWebsiteMalwareBazaarInformationMalware hashes and metadata
abuse.ch Feodo TrackerWebsiteFeodo TrackerInformationBotnet command-and-control infrastructure
AlienVault OTXWebsiteAlienVault OTXInformationCommunity threat-intelligence indicators
PhishTankWebsitePhishTankInformationPhishing intelligence
Shadowserver FoundationWebsiteShadowserverInformationInternet exposure and threat reporting

  1. Sep 17, 2024 · ZeroDay Catalog

    Critical Heap-Based Buffer Overflow Vulnerability in VMware vCenter Server

    A heap-based buffer overflow vulnerability has been identified in VMware vCenter Server, potentially allowing remote code execution by malicious actors.

    What changed

    VMware has disclosed a critical heap-based buffer overflow vulnerability in vCenter Server, specifically related to the implementation of the DCERPC protocol. This vulnerability can be exploited by an attacker with network access to the vCenter Server, who can send specially crafted packets to trigger the flaw.

    Successful exploitation may lead to remote code execution, posing significant risks to affected systems.

    Who is affected

    Organizations utilizing VMware vCenter Server are at risk, particularly those that manage virtualized environments and cloud infrastructures.

    The vulnerability impacts VMware Cloud Foundation, which integrates vCenter Server for managing cloud resources.

    • VMware vCenter Server users
    • VMware Cloud Foundation customers
    • Organizations with network access to vCenter Server instances

    What to do

    Security teams should prioritize assessing their VMware vCenter Server installations for exposure to this vulnerability. Immediate actions include reviewing network access controls and monitoring for unusual activity.

    It is advisable to apply any available patches or updates from VMware as soon as they are released to mitigate the risk of exploitation.

    • Review network access to vCenter Server instances
    • Monitor for suspicious network traffic targeting vCenter Server
    • Apply patches or updates from VMware promptly

    Original report

  2. Jun 25, 2024 · ZeroDay Catalog

    VMware ESXi Authentication Bypass Vulnerability Identified

    A critical authentication bypass vulnerability in VMware ESXi could allow unauthorized access to hosts configured with Active Directory for user management.

    What changed

    VMware has reported an authentication bypass vulnerability in its ESXi product. This flaw allows a malicious actor with sufficient Active Directory permissions to gain unauthorized access to an ESXi host that utilizes Active Directory for user management.

    The vulnerability arises when an attacker recreates a previously deleted Active Directory group, typically named 'ESXi Admins', thereby circumventing the authentication mechanisms in place.

    Who is affected

    Organizations using VMware ESXi for virtualization and cloud infrastructure management are at risk, particularly those that integrate Active Directory for user management.

    The following groups are particularly vulnerable:

    • VMware ESXi users with Active Directory integration.
    • Organizations relying on the default 'ESXi Admins' group for administrative access.
    • IT departments managing cloud infrastructure with VMware Cloud Foundation.
    • Any enterprise that has previously deleted the 'ESXi Admins' group from Active Directory.

    What to do

    It is crucial for affected organizations to assess their current Active Directory configurations and ensure that the 'ESXi Admins' group is not deleted or misconfigured.

    Regular audits of group permissions and access controls should be implemented to mitigate potential exploitation of this vulnerability.

    • Review Active Directory group configurations related to VMware ESXi.
    • Recreate the 'ESXi Admins' group if it has been deleted to restore proper access controls.
    • Monitor for any unauthorized access attempts to ESXi hosts.
    • Stay updated with VMware's security advisories for any patches or further guidance.

    Original report