Risk
2/27/2008
04:37 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

VMware Moves To Protect Applications Living On The Hypervisor

On the heels of a file sharing flaw uncovered earlier this week by a security firm, and the announcement of a number of security patches, virtualization leader VMware says it plans to release an API for third-party security applications.

On the heels of a file sharing flaw uncovered earlier this week by a security firm, and the announcement of a number of security patches, virtualization leader VMware says it plans to release an API for third-party security applications.It's an initiative VMware calls VMsafe, and it aims to protect applications running within virtual machines. VMsafe will enable security vendors to build their applications to integrate with the Hypervisor. Essentially, the hypervisor is a layer of software that runs independent of the primary operating system and manages virtual machines.

According to a statement from VMware, VMsafe will provide security software makers access to the memory, CPU, and I/O systems of the virtual machine.

So far, about 20 security vendors have signed up, including Blue Lane, Cenzic, Check Point Software, F5, Fortinet, IBM, and Symantec.

"Symantec is exploring opportunities with VMware to deliver security solutions to customers using VMware environments," said Bruce McCorkendale, an engineer at Symantec in a statement. "We expect the VMsafe technology to be a key enabler in our ongoing efforts."

These APIs are definitely a step in the right direction, and will provide for more security options when it comes to locking down virtual machines. The catch, however, is that the more APIs that are created also creates more potential attack points. The devil, as always, will be in the details, and the implementation.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

CVE-2014-2716
Published: 2014-12-19
Ekahau B4 staff badge tag 5.7 with firmware 1.4.52, Real-Time Location System (RTLS) Controller 6.0.5-FINAL, and Activator 3 reuses the RC4 cipher stream, which makes it easier for remote attackers to obtain plaintext messages via an XOR operation on two ciphertexts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.