Latest: Digital For Tech News Click Here


Monday 21 April 2014

VMware’s ‘vSphere vuln’ patches released to overcome man-in-the-middle

0 comments
place Google AdSense code here


VMware has released an update to its vSphere Client which reports a potential – but hard to target – man-in-the-middle vulnerability for the virtu-lization tool.

The company said that users running vSphere Client 4.0, 4.1, 5.0, and 5.1 for Windows were vulnerable to a flaw that allows the client to download and install untrusted updates. Were an attacker to exploit the flaw, VMware said that users could be subject to remote code execution attacks via a malicious link or redirect.

Whereas systems running vSphere Client 5.5 are not vulnerable to the flaw.

Steve Pate, chief architect at virtualization security firm HyTrust, said that while administrators should always make sure users are running fully patched software, the risk of attacks targeting this vulnerability in the wild are likely to be low.

Pate explained that in the case of the vSphere Client vulnerability, an attacker would have to get in the middle of an update chain that runs when the vCenter Server platform is updated and no longer matches the end user's version of the vSphere client, at which point the vulnerable component is launched.

The update comes just two days after VMware told users that 28 of its products contain versions of OpenSSL subject to the infamous Heartbleed security flaw.

The company has yet to roll out a fix for that flaw as it releases the patch for the vSphere Client vulnerability. Still, administrators need not fret much over their VMware products, Pate said.
He prominent that as few VMware implementations directly face the public web, the risk posed by Heartbleed will be lower than that of platforms and applications that are more readily accessible to potential attackers

0 comments: Post Yours! Read Comment Policy ▼
PLEASE NOTE:
We have Zero Tolerance to Spam. Chessy Comments and Comments with Links will be deleted immediately upon our review.

Post a Comment

 
Copyright © 2013 MyBloggerBlog Template All Right Reserved
Designed by MyBloggerBlog | Powered by Blogger