VMware Server 1.0.4 released (security fixes)

A few days ago, VMware put out VMware Server 1.0.4. Although there appear to be some plain old bug fixes, the real news here is that a couple of very nasty security bugs that have been fixed, including “VM-breakout” class bugs that could allow a malicious VM to compromise the host.

I’d imagine that it’s only a matter of time before VM monitor / hypervisor bugs become as big a deal as standard operating system bugs. For those that are already deploying virtualized infrastructure, that is probably already true even now to an extent.

What’s nasty about VM breakout bugs is that they can very easily lead to large numbers of machines being compromised in a fairly stealthy way. There’s been a whole lot of good discussion about hypervisor-based rootkits and malware recently. Although detecting an unexpected layering of hypervisor is one thing, telling the difference between a hypervisor that’s supposed to be running and a compromised hypervisor that’s supposed to be running, from the context of a guest, is an entirely different factor altogether. To a clever attacker, a hypervisor compromise is a pretty scary thing.

Now, I’m not trying to call fire and brimstone down on VMware or anything like that, and the bug in this case is reportedly not remotely exploitable without remote admin access to a guest. But all the same, hypervisor / VM monitor bugs are certainly nothing to be shaking a stick at.

Anyways, if you use VMware and you’ve got VMs that are either untrusted or allow non-admistrative access, it’s time to (borrowing a friend’s term) ready the patch brigade if you have not already.

2 Responses to “VMware Server 1.0.4 released (security fixes)”

  1. I’m still waiting for someone to mount a side-channel timing attack of the kind described last year about RSA against a VM host. It seems like it’d be feasible (if not easy) to get an e.g. SSH key from a host operating only from the guest. Complex, but feasible.

  2. c1de0x says:

    VM-Breakout bugs are really serious, especially for organizations *relying* on Virtualization for security purposes.

    I wonder how many breakout vulnerabilities exist for the popular desktop virtualization tools (VMWare Workstation, Xen,…).

    Steve: you got a link to info on that attack?