One of the less critical vulnerabilities, rated only as Important, is nevertheless quite interesting: MS10-010, which addresses a vulnerability in the virtualization component of Windows 2008: the hypervisor. The flaw enables a guest operating system running under the hypervisor to crash the Windows 2008 host, affecting all virtual machines running on the same host. The vulnerability falls short of the real goal: controlling the host operating system and being able to exploit the other guest operating systems hosted on the same physical machine. Still, this is a sign that we will see more significant vulnerabilities in the near future affecting virtualization technologies. Specialized security researchers have been working for years on virtualization, and we have seen impressive results being presented and discussed -- most notably by Joanna Rutkowska's Red/Blue Pill and Kortchinsky's CloudBurst presentations at BlackHat.
Virtualization is increasingly becoming an important building block for corporate server infrastructures, and it is a key technology used in many cloud computing initiatives, primarily in the Infrastructure-as-a-Service (IaaS) arena. IT administrators need to acknowledge this technology as a first-class operating system that requires its own monitoring toolset, dedicated security procedures, and hardening policies.
-- As the CTO for Qualys, Wolfgang Kandek is responsible for product direction and all operational aspects of the QualysGuard platform and its infrastructure. Wolfgang has more than 20 years of experience in developing and managing information systems. His focus has been on Unix-based server architectures and application delivery through the Internet. Wolfgang provides the latest commentary on his blog: laws.qualys.com and also publishes his Patch Tuesday commentary to the QualysGuard channel: www.youtube.com/QualysGuard. He is a frequent source in business and trade media and speaks at industry conferences around the world, most recently at RSA 2009.