Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
VENOM Zero-Day May Affect Thousands Of Cloud, Virtualization Products
Newest First  |  Oldest First  |  Threaded View
ODA155
50%
50%
ODA155,
 User Rank: Ninja
5/15/2015 | 9:28:37 AM
Re: Good Research Bad Media Reaction
@ kenwestin ... You said... "I do believe that some of the media surrounding this vulnerability has been a bit overblown, some stating that this vulnerability is has broken cloud security and millions of systems are in danger of being immediately hacked."

I think what is overblown is how everyone wants to compare one vulnerability to the other; I personally think that is dangerous. Why, because no two vulnerabilities are the same there is no way that you can compare this vulnerability to Heartbleed or to a vulnerability like BEAST. With Heartbleed it was pretty easy to say how big this would be because there was no denying it. With this particular vulnerability, it does confirm an argument that has been going on for a very long time that quite a few folks said could not happen. And this, as with Heartbleed has internal implications too if these affected systems are used inhouse.  And while this particular bug has not impacted all of the virtual space... I can bet you the rest are scrambling to make sure it doesn't affect them too. Remember, when Heartbleed was first reported nobody took as seriously as they did when the scope was finally realized.

"High impact vulnerabilities are becoming the new normal, some security analysts expecting us to see one big one per quarter. The industry as a whole needs to work on how to best address these vulnerabilities without overhyping them..."

Now this I can totally agree with, but my one bit of advice would be to assume that every vulnerability has the ability to disrupt your operations or possible damage your reputation.

Question, which was worse:

a)      Blaster

b)      SQL Slammer
sixscrews
50%
50%
sixscrews,
 User Rank: Apprentice
5/14/2015 | 6:31:46 PM
So, why is your disk floppy?
OK, we have a vlun - surprise.

But it's in a component that maybe 50% of us have never touched, much less know about.

And where's the next one coming from - the joystick interface?  the UV-EEPROM programmer?

I'm not surprised stuff shows up in negelceted interfaces but the thing that surprises me is why a bright shiny VM should have a floppy interface component at all.  Are people looking at the stuff that's added into a VM build and being sure it's necessary?

Hard drive interface - check

Video interface - check

Keyboard interface - check

Mouse interface - check

Serial port interface - check

Parallel port interface - check - uh - what's a parallel port?

Tin hat interface protection - check

Rubber band motor back up interface - check

And so it goes - the path to h#$l is paved with ignorance and obsolete interfaces.

wb/ss
ODA155
50%
50%
ODA155,
 User Rank: Ninja
5/14/2015 | 5:22:39 PM
Re: Re-thinking VM Deployement
... and the problem with vulnerabilities is what... they do not go away!  Because there will always be a management\admin team somewhere that doesn't get it... try to skate on that thin ice for as long as possible or not willing to spend what it takes to fix it.

And you're correct about the PCI Council, so in my opinion, (which I'm pretty sure they care nothing about) this vulnerability confirms what security folks have been saying for years, that this is possible and hopefully forces the PCI Council to do the right thing... but you can probably hear the crocodile tears hitting the floor already from the large vendors asking for exceptions and grandfather (not Santa) clauses.
Sara Peters
50%
50%
Sara Peters,
 User Rank: Author
5/14/2015 | 5:13:32 PM
Re: Re-thinking VM Deployement
@ODA155  Good point! That's been the question about virtualization forever, and the PCI Council was hesitant to make a ruling on it in the beginning. That said... ultimately, Venom is just a vulnerability. Until this, or a similar vuln, gets exploited in any significant fashion, I doubt the regulators would make any changes.
ODA155
50%
50%
ODA155,
 User Rank: Ninja
5/14/2015 | 4:27:22 PM
Re-thinking VM Deployement
So I aked this question internally just to speark discussion, so now I'll ask it here...

"If this is in fact a possibility then this would be a game-changer, especially in how organizations plan or decide what VM's reside on a specific host, such as can\should a VM subject to PCI or HIPAA be hosted on the same platform as non PCI or VM's. If so, do\should the non compliance required VM's have to me those compliance standards?"
kenwestin
100%
0%
kenwestin,
 User Rank: Apprentice
5/13/2015 | 4:41:57 PM
Good Research Bad Media Reaction
The research on this particular vulnerability is excellent,  Jason Geffner and the folks who researched and are patching this should be commended. However, I do believe that some of the media surrounding this vulnerability has been a bit overblown, some stating that this vulnerability is has broken cloud security and millions of systems are in danger of being immediately hacked.

However, the actual impact is nowhere near a doomsday scenario, or the same level of  Heartbleed to which this is being compared to in the media. This vulnerability did not affect Amazon AWS, Linode or a any other number of cloud service providers. There are also a number of factors that have to be in place for the vulnerability to pose an actual risk. 

High impact vulnerabilities are becoming the new normal, some security analysts expecting us to see one big one per quarter. The industry as a whole needs to work on how to best address these vulnerabilities without overhyping them, or we are going to run into a boy who cried wolf scenario and businesses and security leaders will become numb to the next real threat they need to patch in their environment. 


News
News
Inside the Ransomware Campaigns Targeting Exchange Servers
Kelly Sheridan, Staff Editor, Dark Reading,  4/2/2021
Commentary
Beyond MITRE ATT&CK: The Case for a New Cyber Kill Chain
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  3/30/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3243
PUBLISHED: 2021-04-15
Wfilter ICF 5.0.117 contains a cross-site scripting (XSS) vulnerability. An attacker in the same LAN can craft a packet with a malicious User-Agent header to inject a payload in its logs, where an attacker can take over the system by through its plugin-running function.
CVE-2021-29448
PUBLISHED: 2021-04-15
Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.
CVE-2021-30138
PUBLISHED: 2021-04-15
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE-2021-27112
PUBLISHED: 2021-04-15
LightCMS v1.3.5 contains a remote code execution vulnerability in /app/Http/Controllers/Admin/NEditorController.php during the downloading of external images.
CVE-2021-20288
PUBLISHED: 2021-04-15
An authentication flaw was found in ceph in versions before 14.2.20. When the monitor handles CEPHX_GET_AUTH_SESSION_KEY requests, it doesn't sanitize other_keys, allowing key reuse. An attacker who can request a global_id can exploit the ability of any user to request a global_id previously associa...