VMSA-2020-0018

Moderate

Advisory ID: VMSA-2020-0018

CVSSv3 Range: 5.3

Issue Date: 2020-08-20

Updated On: 2020-08-20 (Initial Advisory)

CVE(s): CVE-2020-3976

Synopsis: VMware ESXi, vCenter Server, and Cloud Foundation updates address a partial denial of service vulnerability (CVE-2020-3976)

1. Impacted Products

VMware ESXi
VMware vCenter Server (vCenter Server)
VMware Cloud Foundation (Cloud Foundation)

2. Introduction

A partial denial of service vulnerability in VMware ESXi and vCenter Server was privately reported to VMware. Patches and updates are available to remediate these vulnerabilities in affected VMware products.

3. Partial denial of service vulnerability via authentication services (CVE-2020-3976)

Description

VMware ESXi and vCenter Server contain a partial denial of service vulnerability in their respective authentication services. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.

Known Attack Vectors

A malicious actor with network access to ESXi or vCenter may be able to exploit this vulnerability to exhaust memory resources resulting in a degradation of performance condition while the attack is sustained.

Resolution

To remediate CVE-2020-3976 apply the patches listed in the 'Fixed Version' column of the 'Response Matrix' found below.

Workarounds

None.

Additional Documentation

None.

Acknowledgements

VMware would like to thank weinull of Orz Team for reporting this issue to us.

Notes

None.

Response Matrix

Product	Version	Running On	CVE Identifier	CVSSv3	Severity	Fixed Version	Workarounds	Additional Documentation
ESXi	7.0	Any	CVE-2020-3976	5.3	moderate	ESXi_7.0.0-1.25.16324942	None	None
ESXi	6.7	Any	CVE-2020-3976	5.3	moderate	ESXi670-202008101-SG ESXi670-202008401-BG	None	None
ESXi	6.5	Any	CVE-2020-3976	5.3	moderate	ESXi650-202007401-BG ESXi650-202007101-SG	None	None
Cloud Foundation (ESXi)	4.x.x	Any	CVE-2020-3976	5.3	moderate	4.0.1	None	None
Cloud Foundation (ESXi)	3.x.x	Any	CVE-2020-3976	5.3	moderate	3.10.0	None	None
vCenter Server	7.0	Any	CVE-2020-3976	5.3	moderate	7.0.0b	None	None
vCenter Server	6.7	Any	CVE-2020-3976	5.3	moderate	6.7u3j	None	None
vCenter Server	6.5	Any	CVE-2020-3976	5.3	moderate	6.5u3k	None	None
Cloud Foundation (vCenter)	4.x.x	Any	CVE-2020-3976	5.3	moderate	4.0.1	None	None
Cloud Foundation (vCenter)	3.x.x	Any	CVE-2020-3976	5.3	moderate	3.10.1	None	None