QID 374575

QID 374575: VMware vRealize Operations Application Remote Collector (ARC) Multiple Vulnerabilities (VMSA-2020-0009)

vRealize Application Remote Collector enables virtual infrastructure administrators and application administrators to discover applications running in provisioned Guest operating systems at a scale and to collect run-time metrics of the operating system and application for monitoring and troubleshooting respective entities.

vRealize Operations Application Remote Collector (ARC) addresses Authentication Bypass (CVE-2020-11651) and Directory Traversal (CVE-2020-11652) vulnerabilities.

Affected Versions:
vRealize Operations ARC 8.1.0 prior to 8.1.0.38178 Build 16187903
vRealize Operations ARC 8.0.x prior to 8.0.1.38184 Build 16189281
vRealize Operations ARC 7.5.0 prior to 7.5.0.38179 Build 16188146

QID Detection Logic:(Authenticated)
It reads /opt/vmware/etc/appliance-manifest.xml file to check the vulnerable version of the product.

Successful exploitation of these vulnerabilities
- may allow a malicious actor with network access to port 4505 or 4506 on the ARC to take control of the ARC and any Virtual Machines the ARC may have deployed a Telegraf agent to.
- may allow a malicious actor with network access to port 4505 or 4506 on the ARC to access the entirety of the ARC filesystem.

  • CVSS V3 rated as Critical - 9.8 severity.
  • CVSS V2 rated as High - 7.5 severity.
    • Solution
    The vendor has released patches which can be found here ARC 8.1.0.38178 Build 16187903 , ARC 8.0.1.38184 Build 16189281 , ARC 7.5.0.38179 Build 16188146Workaround:
    for Workaround , please visit the vendor advisory KB79031
    Vendor References

    CVEs related to QID 374575

    CVE-2020-11651 | CVE-2020-11652 |
    Software Advisories
    Advisory ID Software Component Link
    ARC 7.5.0.38179 Build 16188146 URL Logo my.vmware.com/web/vmware/details?downloadGroup=VROPS-750&productId=875&rPId=32115
    ARC 8.0.1.38184 Build 16189281 URL Logo my.vmware.com/web/vmware/details?downloadGroup=VROPS-801&productId=940&rPId=40733
    ARC 8.1.0.38178 Build 16187903 URL Logo my.vmware.com/web/vmware/details?downloadGroup=VROPS-810&productId=991&rPId=45691
    By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].