Threat Level: green Handler on Duty: Johannes Ullrich

SANS ISC: VMWare ESX/ESXi Security Advisory - SANS Internet Storm Center SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
VMWare ESX/ESXi Security Advisory

On Sunday, VMWare released a security advisory VMSA-2013-0016 and involves the ESX (versions 4.0 & 4.1) and ESXi (versions 4.0 through 5.5) products.  A vulnerability exists within the products which could allow an unpriviledged vCenter user to arbitrarily have read or write access to files. Removing the "Add Existing Disk" permission or limiting the number of vCenter users with this priviledge can reduce the risk of exploitation until updates can be applied.   More details are available at the VMWare Security Advisory page located at http://www.vmware.com/security/advisories/VMSA-2013-0016.html

--

Scott Fendley
ISC Handler

ScottF

187 Posts
ISC Handler
For more detailed information, we released a whitepaper describing this vulnerability a while ago: http://www.insinuator.net/2013/02/vmdk-has-left-the-building-newsletter/
Anonymous

Posts

Sign Up for Free or Log In to start participating in the conversation!