Sep 5, 2023

The vulnerability has been determined as a security risk with high severity, potentially enabling remote attackers to bypass SSH (Secure Shell) authentication, thus gaining unauthorised access to private endpoints
Surrey, United Kingdom Sep 4, 2023 (Issuewire.com) - Geeky News--a trusted tech and lifestyle journal--recently reported on the critical vulnerabilities impacting VMware Aria Operations for Networks that have been brought to light. VMware, a prominent multi-cloud service provider, has issued a security advisory regarding this concerning discovery. The vulnerability, classified security risk with high severity, potentially allows remote attackers to bypass SSH (Secure Shell) authentication, thereby gaining unauthorised access to private endpoints.
VMware Aria Operations for Networks, previously known as vRealize Network Insight, serves as VMware's comprehensive suite for managing and monitoring virtualised environments and hybrid cloud infrastructures. It consolidates essential VMware services, such as vRealize Operations, vRealize Automation, vRealize Network Insight, and CloudHealth, into a unified Aria Hub console. This central hub provides users with a singular point for overseeing their entire multi-cloud environment. It encompasses robust features for system security, capacity planning, log management, IT automation, analytics generation, and comprehensive operations management.
The vulnerability in question--tracked as CVE-2023-34039--carries a CVSS v3 score of 9.8, categorising it as "critical." Discovered by Project Discovery Research, this flaw presents a substantial security risk across all Aria 6.x branch versions. In response, VMware promptly issued a security advisory to address this pressing issue.
VMware's advisory emphasises the inherent risk associated with the exploitation of this vulnerability. It states, "Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. A malicious actor with network access to Aria Operations for Networks could bypass SSH authentication to gain access to the Aria Operations for Networks CLI."
Exploiting this vulnerability could lead to severe consequences, including data manipulation or exfiltration through the product's command line interface. Depending on network configurations, the flaw may result in malware installations, network disruptions, unauthorised configuration changes, and lateral movement within the network.
To mitigate the risk posed by this vulnerability, customers are strongly urged to upgrade to Aria version 6.11, which includes comprehensive fixes for CVE-2023-34039. VMware has also provided the KB94152 patch as a temporary solution for users who cannot immediately upgrade to Aria version 6.11.
Furthermore, the same patch addresses another high-severity security flaw, identified as CVE-2023-20890, with a maximum CVSSv3 base score of 7.2. According to VMware's advisory, this vulnerability could enable "an authenticated malicious actor with administrative access to VMware Aria Operations for Networks to write files to arbitrary locations, resulting in remote code execution."
Given the significance of these vulnerabilities and their potential impact, large organisations with valuable assets must remain vigilant and proactive in addressing them.
Organisations are encouraged to integrate vulnerability intelligence into their vulnerability and threat management strategies. Real-time, automated, and AI-powered vulnerability intelligence solutions, such as Prism Platform by Rootshell Security, not only identify issues but also pinpoint security vulnerabilities in software that are actively exploited.
For more in-depth information, please read the full article on Geeky News at https://www.geekynews.co.uk/vmware-addressses-multiple-vulnerabilities/
Media Contact
Geeky News
+44 20 3800 1212
Parallel House, 32 London Road Guildford, Surrey
Source :Geeky News
This article was originally published by IssueWire. Read the original article here.
Fall is the best time of year to travel! View Entire Post ›
Lane Kiffin’s decision to leave Ole Miss only days before their first college football playoffs to coach their long-time rivals, the LSU Tigers, has not been received well by his old team – and things got especially heated ahead of the LSU vs. Ole Miss match on September 20, with the latter claiming victory. Landry Kiffin, Kiffin’s oldest daughter, who is a student at Ole Miss, reportedly had several banners with inappropriate and explicit remarks directed at her. In response to the harassment,...
Indiahikes has signed an MoU with the Andaman & Nicobar Administration to identify, develop and document two multi-day trekking trails across the islands. The one-year collaboration will include trail exploration, pilot trekking experiences, local skill-building, photography and video documentation, and a guidebook, with a focus on sustainable trekking and community participation.
In 2024, French artisanal cookie company Sucré did a four-day pop-up in Hong Kong. The response was overwhelming, says Louise Lui, the brand’s Hong Kong-born co-founder. “There was already a queue forming outside 25 minutes before us selling,” she says. “And then I was just like, ‘Oh my God, how do you know about us?’” When developing recipes for the pop-up, Lui and her French partner in life and business, Victor Selle, wanted something that would bridge cultures. They landed on familiar Asian...
The latest Post Office Travel Money Winter Sun Report examines costs on the ground, from three-course meals to the price of sunscreen - and reveals the cheapest places to travel to this winter.
Neil and Janet Payne call it "Le Hip Trip." The Kinkora, P.E.I., couple were facing a wait of up to a year and a half for Neil’s hip replacement — so instead of waiting, they borrowed $25,000 and drove to a private clinic in Quebec.
Hong Kong designer Kinyan Lam’s autumn/winter 2026 collection, Grounded, is more than a seasonal drop. It sets a clear vision for the future of his eponymous brand: that slowing down is the only way forward. “I heard a saying that plants and trees have two ways of growing: they explode into the world, but their roots continue to dig deep into the soil,” says Lam, who is in his thirties. “Right now, I am just a small tree, and I want to grow my roots deeper so I can grow into a big tree. This is...
Testosterone is touted as a cure-all for menopause symptoms on social media, and more women are now taking it off-label. Scientists want more research.
New StatCan data shows sharply different drug-use patterns across eight Canadian cities, with methamphetamine elevated in parts of the Prairies and Moncton, cocaine comparatively high in Halifax and fentanyl highest in Metro Vancouver.
A whistleblower lawsuit in California is alleging millions of pounds of Driscoll's fruit containing non-compliant levels of pesticides and chemicals crossed the border into Canada, and the company tried to cover it up.
On Oct. 1 Canadian Space Agency astronaut Joshua Kutyrk will blast off from Cape Canaveral, Fla., and he’s bringing some innovative Canadian tech with him.
The Maldives is preparing to welcome travel and tourism leaders from across the region for the World Travel Awards Asia, Oceania & Indian Ocean Gala Ceremony 2026, powered by Bank of Maldives. The ceremony will take place at CROSSROADS Maldives on Sunday, 27 September 2026, coinciding with World Tourism Day. The evening will bring together leading travel, tourism and hospitality brands from across Asia, Oceania and the Indian Ocean to celebrate excellence across a wide range of categories, including hotels, resorts, airlines, tour operators, destinations and tourism attractions.
YOUR NEWS, OUR NETWORK.
Do you have Great News you want to tell the world?
Be it updates about your business or your community, you can make sure that it’s heard by submitting your story to our network reaching hundreds of news sites across 6 verticals.