VMware fixes ESX 4.1 hypervisor flaw

Threat monitor

VMware fixes ESX 4.1 hypervisor flaw

Ron Condon, UK Bureau Chief

VMware Inc. has released a security advisory, warning users of its ESX 4.1 software that a vulnerability in the hypervisor could allow a local user to gain local privileges.

The company issued a patch, Monday,

Continue Reading This Article

Enjoy this article as well as all of our content, including E-Guides, news, tips and more.

By submitting your email address, you agree to receive emails regarding relevant topic offers from TechTarget and its partners. You can withdraw your consent at any time. Contact TechTarget at 275 Grove Street, Newton, MA.

You also agree that your personal information may be transferred and processed in the United States, and that you have read and agree to the Terms of Use and the Privacy Policy.

Safe Harbor

fixing a stack pointer underflow problem that could fail to block a local user from gaining additional privileges without proper controls.

Any vulnerability in a hypervisor is a serious concern because of the key role it plays in managing a virtualised computing environments. Researchers have been studying ways to attack a VM session via the hypervisor.

According to Tim Orchard, technical director at Hampshire-based pen testing company Activity Information Management Ltd., although this particular vulnerability could not be exploited remotely, there have been some vulnerabilities in the ESX remote management interface in the last year that have been successfully exploited during penetration tests.

Those vulnerabilities included one in the remote management interface for VMWare server which emerged in October 2009 and was not patched until February 2010. "We found this exposed in a customer's DMZ. So theoretically, if you compromised a Web server to gain access to the DMZ network, you could then use this vulnerability to further your exploitation," Orchard said.

However, Orchard said, the threats posed against the hypervisor are currently more theoretical than real. "By putting a number of servers on one device you do provide an attractive target to attack," he said. "There has been significant research into how to attack the hypervisor, but it has been difficult to exploit in the real world."

Orchard said organizations adopting virtualisation can adopt good practices to reduce risk. "Management interfaces to the virtual server are always a potential weakness and should not be exposed externally," he said.

In addition, Orchard said virtualised systems should not be used across security barriers -- for instance, they should not support servers on both sides of a firewall -- because any exploited vulnerability in the virtualisation software could then provide a path around the firewall.

"Like every server, virtualized systems need to be kept up to date with patches and hardened with no unused services running and default accounts disabled," he said. "And remember that not everything needs to be virtualised."