【威胁通告】VMware VCenter Server远程代码执行误差（CVE-2021-21985）通告

2021-05-26

一. 误差概述

5月26日，九游老哥科技CERT监测到VMware官方宣布清静通告，修复了VMware vCenter Server远程代码执行误差（CVE-2021-21985）和vCenter Server插件中的身份验证绕过误差（CVE-2021-21986）；由于vCenter Server中的插件Virtual SAN Health Check缺少输入验证，通过443端口会见vSphere Client(HTML5)的攻击者，可以结构特殊的数据包在目的主机上执行恣意代码。无论是否使用vSAN，vCenter Server都会默认启用该受影响的插件，CVSS评分为9.8，请相关用户接纳步伐举行防护。

vCenter Server是VMware公司的一种服务器治明确决计划，可资助IT治理员通过单个控制台治理企业情形中的虚拟机和虚拟化主机。

参考链接：

https://www.vmware.com/security/advisories/VMSA-2021-0010.html

二. 影响规模

受影响版本

l vmware vcenter_server < 6.5 U3p

l vmware vcenter_server < 6.7 U3n

l vmware vcenter_server < 7.0 U2b

l Cloud Foundation（vCenter Server）< 3.10.2.1

l Cloud Foundation（vCenter Server）< 4.2.1

三. 误差防护

3.1 官方升级

现在官方已在最新版本中修复了该误差，请受影响的用户尽快升级版本举行防护，对应产品版本的下载链接及文档如下：

产品版本	下载链接	操作文档
vCenter Server 7.0 U2b	https://my.vmware.com/en/web/vmware/downloads/info/slug/datacenter_cloud_infrastructure/vmware_vsphere/7_0	https://docs.vmware.com/en/VMware-vSphere/7.0/rn/vsphere-vcenter-server-70u2b-release-notes.html
vCenter Server 6.7 U3n	https://my.vmware.com/en/web/vmware/downloads/info/slug/datacenter_cloud_infrastructure/vmware_vsphere/6_7	https://docs.vmware.com/en/VMware-vSphere/6.7/rn/vsphere-vcenter-server-67u3n-release-notes.html
vCenter Server 6.5 U3p	https://my.vmware.com/en/web/vmware/downloads/info/slug/datacenter_cloud_infrastructure/vmware_vsphere/6_5	https://docs.vmware.com/en/VMware-vSphere/6.5/rn/vsphere-vcenter-server-65u3p-release-notes.html
VMware vCloud Foundation 4.2.1	https://my.vmware.com/en/web/vmware/downloads/details?downloadGroup=VCF421&productId=1121&rPId=67576	https://docs.vmware.com/en/VMware-Cloud-Foundation/4.2.1/rn/VMware-Cloud-Foundation-421-Release-Notes.html
VMware vCloud Foundation 3.10.2.1	https://docs.vmware.com/en/VMware-Cloud-Foundation/3.10.2/rn/VMware-Cloud-Foundation-3102-Release-Notes.html#3.10.2.1