Tag Archive for: VMware ESXi

According to the latest study by Orange Security, 13 percent of the vulnerabilities found in today’s corporate networks were already known in 2012, and almost half of all gaps are more than five years old – and the trend is increasing. Professional vulnerability management such as the Greenbone product family can provide a remedy.

The Orange Security Navigator takes a look at the current threat situation on many pages every year. In the latest edition, the security software manufacturer comes to astonishing insights regarding the age of vulnerabilities in companies. The oldest risks have existed for 20 years or more, writes Orange, and patching is also taking longer and longer.

Even recently, problems that were actually fixed long ago filled the headlines: A security hole in VMWare’s ESXi server, which had been closed for years, was actively exploited by attackers. According to the German Federal Office for Information Security (BSI), thousands of servers were infected with ransomware and encrypted – details here in the Greenbone blog.

Orange Security can also sing from the same song: “Our pentesters find vulnerabilities that were first identified in 2010 (…) [and] problems whose causes go back to 1999. (…) This is a very worrying result.” In the case of the ESXi incident, the vulnerability had already been closed by the manufacturer in February 2021, but not all users had applied the necessary updates – which is exactly where Greenbone’s products help by actively scanning your systems for known, open vulnerabilities.

This is becoming increasingly important because, even according to Orange, more and more critical gaps are sometimes open for six months or longer, In recent years, the average time to a fix has increased by 241 percent. While patching of serious vulnerabilities is on average one-third faster than for less critical threats, the maximum time required to apply a patch is a concern: “Whether critical or not, some patches take years to apply.

Only one-fifth of all vulnerabilities found are fixed in less than 30 days, the study explains, while 80% remain open for more than a month. On average, it takes a full 215 days for gaps to be closed. Of the vulnerabilities waiting 1000 days for a patch, 16% were classified as severe, with three-quarters of medium threat, it said. In the case of the ESXi vulnerability, there has been an alert for two years, a high-risk classification and also a patch to fix it. Despite this, a large number of organizations have been successfully attacked by exploiting the vulnerability.

The problem is well known: Calls for vulnerability and patch management from data protection regulators, for example, are a regular occurrence. “I look at the topic of information security with concern. On the one hand, many organizations still haven’t done their homework to eliminate known vulnerabilities in IT systems – the data breach reports show us how such vulnerabilities are exploited again and again, and often data can be leaked.” Marit Hansen, Schleswig-Holstein State Commissioner for Data Protection, February 2022.

When it comes to cybersecurity, companies face major challenges, she said: More than 22 vulnerabilities with CVE are published every day, with an average CVSS score of 7 or more, she said. Without professional vulnerability management, this can no longer be handled, Orange also explains.

This makes the early detection and recording of vulnerabilities in the company all the more important. Greenbone products can take a lot of the work out of this and provide security – as a hardware or virtual appliance or as a cloud service. The Greenbone Enterprise Feed, from which all Greenbone security products are fed, receives daily updates and thus covers a high percentage of risks. Our security experts have been researching the topic for over 10 years, so we can detect risks even in grown structures.

Vulnerability management is an indispensable part of IT security. It can find risks and provides valuable information on how to eliminate them. However, there is no such thing as one hundred percent security, and there is no single measure that is sufficient to achieve the maximum level of security – vulnerability management is an important building block. Only the totality of the systems deployed, together with comprehensive data protection and cyber security concepts, is the best possible security.

A new wave of ransomware attacks has been threatening numerous servers in Europe. The attacks focus on the hypervisors in VMware’s virtualization server ESXi.
Patches are available, Greenbone’s products can protect and help to find the vulnerability.

The German BSI explicitly warns of the vulnerability and in its latest information on the security situation speaks of thousands of servers and a worldwide threat with a focus on Europe, the U.S. and Canada, using a vulnerability that the manufacturer already patched almost two years ago: (CVE-2021-21974).

Not only VMWare servers themselves at risk

According to IT security portal Hackernews, French provider OVHcloud has confirmed the open source implementation of the IETF Service Location Protocol (OpenSLP) as an entry point.

The threat to IT systems in this case is classified as business-critical – a successful attack with ransomware can therefore cause massive disruptions to regular operations. What is particularly serious about attacks of this type is that under certain circumstances not only institutions that use VMware ESXi themselves are affected, but also third parties – for example, via the server systems hosted in VMware virtualization.

France, Italy, Finland, Canada and the U.S.

Suspicions that European organizations and institutions were the main focus of attackers in the latest wave of attacks were also confirmed a few days later, when the Italian National Cybersecurity Agency ACN warned of the vulnerabilities and a “large-scale wave of attacks.” A Reuters report also speaks of attacks in Finland and the United States.

Users can protect themselves, however: The manufacturer VMware advises upgrading to the latest version of its software – and installing the patch. In general, systems like Greenbone Vulnerability Management help prevent such intrusions by finding the unpatched gaps and proactively warning administrators in reports.

Checking with the Greenbone Cloud

Installation of the VMware patch is free, as is an audit of their systems with the Greenbone Cloud Service Trial. In general, administrators should always ensure that all backups are secured against ransomware and examine log files for suspicious system access – the BSI lists six questions on the checklist in its warning that every administrator should ask themselves now.

Contact Free Trial Buy Here Back to Overview