=====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN599
_____________________________________________________________________

DATE                : 10/11/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running VMware vCenter Server,
                           Cloud Foundation (vCenter Server).

=====================================================================
https://www.vmware.com/security/advisories/VMSA-2021-0025.html
_____________________________________________________________________

Advisory ID:     VMSA-2021-0025
CVSSv3 Range:    7.1
Issue Date:      2021-11-10
Updated On:      2021-11-10 (Initial Advisory)
CVE(s):          CVE-2021-22048


Synopsis:
VMware vCenter Server updates address a privilege escalation
vulnerability (CVE-2021-22048)



1. Impacted Products

VMware vCenter Server (vCenter Server)
VMware Cloud Foundation (Cloud Foundation)


2. Introduction
A privilege escalation vulnerability in VMware Center Server was
privately reported to VMware. Workarounds are available to remediate
this vulnerability in the affected VMware products.


3. VMware vCenter Server IWA privilege escalation vulnerability
(CVE-2021-22048)

Description

The vCenter Server contains a privilege escalation vulnerability in the
IWA (Integrated Windows Authentication) authentication mechanism. VMware
has evaluated the severity of this issue to be in the Important severity
range with a maximum CVSSv3 base score of 7.1.


Known Attack Vectors

A malicious actor with non-administrative access to vCenter Server may
exploit this issue to elevate privileges to a higher privileged group.


Resolution

None.


Workarounds

Workaround for CVE-2021-22048 is to switch to AD over LDAPS
authentication/Identity Provider Federation for AD FS (vSphere 7.0 only)
from Integrated Windows Authentication (IWA) as documented in the KB
listed in the 'Workarounds' column of the 'Response Matrix' below.


Additional Documentation

None.


Notes

None.


Acknowledgements

VMware would like to thank Yaron Zinar and Sagi Sheinfeld of Crowdstrike
for reporting this issue to us.


Response Matrix

Product    Version    Running On    CVE Identifier    CVSSv3    Severity   
Fixed Version    Workarounds    Additional Documentation

vCenter Server    7.0    Any    CVE-2021-22048    7.1    Important
Patch pending    KB86292    None

vCenter Server    6.7    Any    CVE-2021-22048    7.1    Important
Patch Pending    KB86292    None


Impacted Product Suites that Deploy Response Matrix Components:

Product    Version    Running On    CVE Identifier    CVSSv3    Severity   
Fixed Version    Workarounds    Additional Documentation

Cloud Foundation (vCenter Server)    4.x    Any    CVE-2021-22048
7.1    Important     Patch pending    KB86292    None

Cloud Foundation (vCenter Server)    3.x    Any    CVE-2021-22048
7.1    Important     Patch Pending    KB86292    None



4. References

KB86292
https://kb.vmware.com/s/article/86292

Mitre CVE Dictionary Links:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22048

FIRST CVSSv3 Calculator:
CVE-2021-22048: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H


5. Change Log

2021-11-10 VMSA-2021-0025
Initial security advisory.



6. Contact
E-mail list for product security notifications and announcements:
https://lists.vmware.com/mailman/listinfo/security-announce


This Security Advisory is posted to the following lists:

security-announce@lists.vmware.com
bugtraq@securityfocus.com
fulldisclosure@seclists.org



E-mail: security@vmware.com

PGP key at:
https://kb.vmware.com/kb/1055


VMware Security Advisories
https://www.vmware.com/security/advisories


VMware Security Response Policy
https://www.vmware.com/support/policies/security_response.html


VMware Lifecycle Support Phases
https://www.vmware.com/support/policies/lifecycle.html


VMware Security & Compliance Blog
https://blogs.vmware.com/security


Twitter
https://twitter.com/VMwareSRC


Copyright 2021 VMware Inc. All rights reserved.


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================