nav search
Data Center Software Security Transformation DevOps Business Personal Tech Science Emergent Tech Bootnotes

vCenter's phone-home 'customer improvement' feature opened remote code execution hole

VMware's also released first vSphere 6.5 hardening guide

By Simon Sharwood, 18 Apr 2017

Ever worried that software phoning home application performance data so vendors can learn from real-world users might become an attack vector? If so, your nightmare just came true: VMware's vCenter has just that problem, thanks to its use of the Adobe-derived open source BlazeDS messaging tool to process messages.

VMware's issued patches to vCenter 6.0 and vCenter 6.5, both rated critical. Previous versions of vCenter don't have the problem. But even users who opted out of VMware's Customer Experience Improvement Program are susceptible.

The news isn't all bad for VMware on the security front: last week its VSAN hyperconverged software stack won a spot on the Defense Information Systems Agency's Security Technical Implementation Guide. Making the list means VSAN is certified to run on United States Department of Defence networks. Virtzilla reckons VSAN's the first hyperconverged stack to score a spot on the list. VMware has deep entanglements with the US military, so this will be welcome news as it gives the company a good chance of upgrading agencies to its ever-more-extensive range of wares. VSAN's also rated secure enough to run on a nuclear submarine, so Pentagon workloads should be a doddle.

The company's also popped the first hardening guide for vSphere 6.5. Some of the guide's (.XLSX) 68 suggestions aren't rocket science – you probably don't need to be told to keep ESXi patched. But there's also some nicely detailed stuff on topics like how best to configure bidirectional authentication when connecting vSphere to an iSCSI device. ®

The Register - Independent news, views and opinion for the tech sector. Part of Situation Publishing