Virtualization technology giant VMware on Tuesday shipped a major security update to correct at least two critical vulnerabilities in its Aria Operations for Networks product line.
In a critical-severity advisory, VMware said the flaws could be exploited by malicious hackers to bypass SSH authentication and gain access to the Aria Operations for Networks command line interface.
VMware tagged the network authentication bypass issue as CVE-2023-34039 and applied a CVSS severity score of 9.8 out of 10.
“Aria Operations for Networks contains an authentication bypass vulnerability due to a lack of unique cryptographic key generation. VMware has evaluated the severity of this issue to be in the critical severity range with a maximum CVSSv3 base score of 9.8,” the company said.
The VMware Aria Operations for Networks product, formerly vRealize Network Insight, is used by enterprises to monitor, discover and analyze networks and applications to build secure network infrastructure across clouds.
The company said the Aria Operations for Networks collectors are impacted by the vulnerability but advised customers that upgrading the platform appliance will remediate the issue.
VMware also shipped a patch for a second bug — CVE-2023-20890 — that allows an authenticated malicious actor with administrative access to VMware Aria Operations for Networks to write files to arbitrary locations.
VMware has struggled with security problems in the Aria Operations for Networks product, recently patching a gaping command injection flaw that was remotely exploited in the wild.
The Aria Operations for Network product has been tagged in the U.S. government’s CISA Known Exploited Vulnerabilities catalog.
Related: VMware Confirms Exploits Hitting Just-Patched Security Bug
Related: CISA Tells Agencies to Patch Roundcube, VMware Flaws
Related: VMware Plugs Critical Holes in Network Monitoring Tool
Related: Exploit Published for Major Flaw in VMware Logging Software
Ryan Naraine is Editor-at-Large at SecurityWeek and host of the popular Security Conversations podcast series. He is a security community engagement expert who has built programs at major global brands, including Intel Corp., Bishop Fox and GReAT. Ryan is a founding-director of the Security Tinkerers non-profit, an advisor to early-stage entrepreneurs, and a regular speaker at security conferences around the world.
More from Ryan Naraine
- Bankrupt IronNet Shuts Down Operations
- AWS Using MadPot Decoy System to Disrupt APTs, Botnets
- Progress Software Patches Critical Pre-Auth Flaws in WS_FTP Server Product
- Chinese Gov Hackers Caught Hiding in Cisco Router Firmware
- CISA Unveils New HBOM Framework to Track Hardware Components
- Gem Security Lands $23 Million Series A Funding
- New ‘Sandman’ APT Group Hitting Telcos With Rare LuaJIT Malware
- CrowdStrike to Acquire Application Intelligence Startup Bionic
Latest News
- Bankrupt IronNet Shuts Down Operations
- AWS Using MadPot Decoy System to Disrupt APTs, Botnets
- Generative AI Startup Nexusflow Raises $10.6 Million
- In Other News: RSA Encryption Attack, Meta AI Privacy, ShinyHunters Hacker Guilty Plea
- Researchers Extract Sounds From Still Images on Smartphone Cameras
- National Security Agency is Starting an Artificial Intelligence Security Center
- CISA Warns of Old JBoss RichFaces Vulnerability Being Exploited in Attacks
- Hackers Set Sights on Apache NiFi Flaw That Exposes Many Organizations to Attacks
