Stories
Slash Boxes
Comments

SoylentNews is people

EMC, VMware Security Bugs Throw Gasoline on Cloud Security Fire

posted by martyb on Friday January 12 2018, @02:44AM   Printer-friendly
from the update-early-and-often dept.

Fnord666 writes:

While everyone was screaming about Meltdown and Spectre, another urgent security fix was already in progress for many corporate data centers and cloud providers who use products from Dell's EMC and VMware units. A trio of critical, newly reported vulnerabilities in EMC and VMware backup and recovery tools—EMC Avamar, EMC NetWorker, EMC Integrated Data Protection Appliance, and vSphere Data Protection—could allow an attacker to gain root access to the systems or to specific files, or inject malicious files into the server's file system. These problems can only be fixed with upgrades. While the EMC vulnerabilities were announced late last year, VMware only became aware of its vulnerability last week.

[...] For those familiar with the architecture of these products, the vulnerabilities may not be a surprise—EMC Avamar and the other applications use Apache Tomcat, which was patched multiple times last year to address critical security vulnerabilities. However, it's not clear whether these patches were incorporated into earlier updates of the EMC and VMware products or if any of the bugs just fixed in updates of the EMC/VMware products were Tomcat related.

Source: https://arstechnica.com/information-technology/2018/01/emc-vmware-security-bugs-throw-gasoline-on-cloud-security-fire/

Original Submission

 
This discussion has been archived. No new comments can be posted.
EMC, VMware Security Bugs Throw Gasoline on Cloud Security Fire | Log In/Create an Account | Top | 13 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

  • (Score: 2) by darkfeline on Friday January 12 2018, @08:02PM (1 child)

    by darkfeline (1030) on Friday January 12 2018, @08:02PM (#621525) Homepage

    "Hard nosed" engineering isn't immune to poor management practices (Volkswagen, anyone?). The problem is corporate/industry demand. The industry demands speed, new UI designs, and marketability over features and correctness. You can't shoot the engineer/messenger for that. If you want to fix the problem, you don't fix the engineers (or "engineers"), you fix the industry (perhaps with regulation *gasp*).

    --
    Join the SDF Public Access UNIX System today!
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  
    Total Score:   2  

  • (Score: 2) by Runaway1956 on Friday January 12 2018, @11:12PM

    by Runaway1956 (2926) Subscriber Badge on Friday January 12 2018, @11:12PM (#621601) Journal

    What Volkswagen did was not "engineering", but "fraud". And, the engineers actively participated in the fraud. I've posted before, that I hate the idea of sacrificing engineers to protect the management. But, I hate the idea of protecting anyone just as much. Doesn't matter how high or how low you are on the totem pole, if you're knowingly, and actively, working to defraud the public, the government, or whoever, you should not have any protections.