VMware vCenter Server (DCERPC heap overflow): A heap overflow in the DCERPC implementation lets an unauthenticated

Impact

A heap overflow in the DCERPC implementation lets an unauthenticated network attacker reach remote code execution on vCenter with a single crafted packet.

Who can reach it

Network access to vCenter Server. No authentication.

What to do

Apply the VMSA fix per Broadcom advisory 24453. vCenter appliance patch and restart. vCenter should never be reachable from tenant or general-purpose networks.

References