Positive Technologies Helps VMware Fix Critical Vulnerability in Cloud Resource Analysis Tool
Added: (Sat May 15 2021)
Pressbox (Press Release) -
May 14, 2021 -- Positive Technologies announced today that its researcher uncovered a dangerous vulnerability in VMware vRealize Business for Cloud, a product designed for cloud costing analysis that helps organizations visualize and plan expenses and compare business indicators. The flaw has been patched by VMware, which published a security advisory.
The vulnerability discovered by Positive Technologies researcher, Egor Dimitrenko (known officially as CVE-2021-21984) has a CVSS v3 score of 9.8, signifying it’s a critical flaw that should be patched immediately. The vulnerability belongs to the pre-auth RCE class (arbitrary command execution on behalf of an unauthenticated user). Attackers can exploit it to obtain full control over the server and conduct attacks on a company's infrastructure.
“Due to the incorrect configuration of the application, an unidentified attacker could gain access to the built-in update mechanism,” notes Dimitrenko. “This function allows them to execute arbitrary commands on the server by exploiting the legitimate mechanism for installing new versions of the product. The errors related to the incorrect configuration of access lists are caused by insufficient testing of new functionality at the time of the release.”
To fix the vulnerability, organizations should follow the recommendations from VMware's official notice. For situations where installing the update isn’t possible, organizations can detect signs of penetration using a SIEM solution (such as MaxPatrol SIEM) that helps identify suspicious behavior on the server, register an incident, and prevent intruders from moving laterally within the corporate network.
This follows previous vulnerabilities discovered by Dimitrenko and disclosed responsibly to VMware, including in its infrastructure monitoring software, VMware vSphere Replication, and the VMware platform for protection of end devices.
About Positive Technologies
For 19 years, Positive Technologies has been creating innovative solutions for information security. We develop products and services to detect, verify, and neutralize the real-world business risks associated with corporate IT infrastructure. Our technologies are backed by years of research experience and the expertise of world-class cybersecurity experts. Over 2,000 companies in 30 countries trust us to keep them safe. Follow us on social media (LinkedIn, Twitter) and the News section at ptsecurity.com.
CONTACT:
Paula Dunne
CONTOS DUNNE COMMUNICATIONS
+1-408-893-8750 (m)
+1-408-776-1400 (o)
paula@contosdunne.com