https://www.channelfutures.com/wp-content/themes/channelfutures_child/assets/images/logo/footer-new-logo.png
  • Home
  • Technologies
    • Back
    • SDN/SD-WAN
    • Cloud
    • RMM/PSA
    • Security
    • Telephony/UC/Collaboration
    • Cable
    • Mobility & Wireless
    • Fiber/Ethernet
    • Data Centers
    • Backup & Disaster Recovery
    • IoT
    • Desktop
    • Artificial Intelligence
    • Analytics
  • Strategy
    • Back
    • Mergers and Acquisitions
    • Channel Research
    • Business Models
    • Distribution
    • Technology Solutions Brokerages
    • Sales & Marketing
    • Best Practices
    • Vertical Markets
    • Regulation & Compliance
  • MSP 501
    • Back
    • 2022 MSP 501 Rankings
    • 2022 NextGen 101 Rankings
  • Intelligence
    • Back
    • Galleries
    • Podcasts
    • From the Industry
    • Reports/Digital Issues
    • Webinars
    • White Papers
  • Channel Futures TV
  • EMEA
  • Channel Chatter
    • Back
    • People on the Move
    • New/Changing Channel Programs
    • New Products & Services
    • Industry Honors
  • Resources
    • Back
    • Advisory Boards
    • Industry Organizations
    • Our Sponsors
    • Advertise
    • 2022 Editorial Calendar
  • Awards
    • Back
    • 2022 MSP 501
    • Channel Influencers
    • Circle of Excellence
    • DE&I 101
    • Channel Partners 101 (CP 101)
  • Events
    • Back
    • CP Conference & Expo
    • MSP Summit
    • Channel Partners Europe
    • Channel Partners Event Coverage
    • Webinars
    • Industry Events
  • About Us
  • DE&I
Channel Futures
  • NEWSLETTER
  • Home
  • Technologies
    • Back
    • SDN/SD-WAN
    • Cloud
    • RMM/PSA
    • Security
    • Telephony/UC/Collaboration
    • Cable
    • Mobility & Wireless
    • Fiber/Ethernet
    • Data Centers
    • Backup & Disaster Recovery
    • IoT
    • Desktop
    • Artificial Intelligence
    • Analytics
  • Strategy
    • Back
    • Mergers and Acquisitions
    • Channel Research
    • Business Models
    • Distribution
    • Technology Solutions Brokerages
    • Sales & Marketing
    • Best Practices
    • Vertical Markets
    • Regulation & Compliance
  • MSP 501
    • Back
    • 2022 MSP 501 Rankings
    • 2022 NextGen 101 Rankings
  • Intelligence
    • Back
    • Galleries
    • Podcasts
    • From the Industry
    • Reports/Digital Issues
    • Webinars
    • White Papers
  • Channel Futures TV
  • EMEA
  • Channel Chatter
    • Back
    • People on the Move
    • New/Changing Channel Programs
    • New Products & Services
    • Industry Honors
  • Resources
    • Back
    • Advisory Boards
    • Industry Organizations
    • Our Sponsors
    • Advertise
    • 2022 Editorial Calendar
  • Awards
    • Back
    • 2022 MSP 501
    • Channel Influencers
    • Circle of Excellence
    • DE&I 101
    • Channel Partners 101 (CP 101)
  • Events
    • Back
    • CP Conference & Expo
    • MSP Summit
    • Channel Partners Europe
    • Channel Partners Event Coverage
    • Webinars
    • Industry Events
  • About Us
  • DE&I
    • Newsletter
  • REGISTER
  • MSPs
  • VARs / SIs
  • Agents
  • Cloud Service Providers
  • Channel Partners Events
 Channel Futures

Security


Shutterstock

Security Vulnerability

Positive Technologies Finds Dangerous Vulnerability in VMware vRealize Cloud Tool

  • Written by Edward Gately
  • May 17, 2021
This vulnerability is ranked as critical because a cybercriminal could take full control of the server.

Positive Technologies has uncovered a dangerous vulnerability in VMware vRealize Business for Cloud, and is asking organizations to install fixes ASAP.

VMWare designed vRealize Business for Cloud for cloud cost analysis. It helps organizations visualize and plan expenses and compare business indicators. VMware patched the flaw and published a security advisory.

Egor Dimitrenko is a Positive Technologies researcher. He discovered the vulnerability and said it’s ranked as critical. That’s because it allows an unauthenticated criminal to take full control of the server and attack the organization’s infrastructure.

“That’s why it is very important to install the fixes provided by the vendor asap,” he said.

Due to the incorrect configuration of the application, an unidentified attacker could gain access to the built-in update mechanism, Dimitrenko said. This function allows them to execute arbitrary commands on the server by exploiting the legitimate mechanism for installing new versions of the product.

Insufficient testing of new functionality at the time of release caused the flaws, he said.

More Severe than Previous VMware Vulnerability

“This vulnerability is more severe than our finding in VMware vSphere Replication,” Dimitrenko said. “That’s because no permission is required to perform an attack for the latest flaw. But VMware vRealize Business for Cloud isn’t found as frequently on the internet as VMware vCenter. We previously discovered a vulnerability affecting this product that would allow attackers to execute arbitrary commands, compromise the vCenter Server, and gain access to sensitive data.”

To fix the vulnerability, businesses should follow the recommendations from VMware‘s official notice. If organizations can’t install the update, they can detect signs of penetration. They can do with a security information and event management (SIEM) solution.

SIEM helps identify suspicious behavior on the server and register an incident. It also prevent intruders from moving laterally within the corporate network.

Earlier this month, Positive Technologies identified new vulnerabilities in Cisco firewalls that could cause denial of service and block access to corporate networks. The two vulnerabilities are in the Adaptive Security Appliance and Firepower Threat Defense within Cisco hardware firewalls. Cisco has patched both.

Tags: MSPs VARs/SIs Best Practices Cloud Security Technologies

Most Recent


  • Cloud Roundup
    Oracle Cloud & AT&T, AWS Lead Cloud News Roundup
    Find out what’s happening with each company and how it all ties to the channel.
  • Mergers acquisitions m&a goldfish crackers
    Latest M&A: IBM, Vonage, Nokia, GoTo, Nitel, Ensono, Huntress, More
    One cybersecurity company's $22 million July acquisition was its largest to date.
  • Why DevOps Teams Need Security Skills and How Shift Left Tools Help
    Developers need cloud-native security skills and tools to build secure code from the start to mitigate risks.
  • Kim Zetter at Black Hat
    Black Hat USA: No Excuses for Cyberattacks to Catch Critical Infrastructure Off Guard
    Critical infrastructure remains just as vulnerable as it was years ago.

Leave a comment Cancel reply

-or-

Log in with your Channel Futures account

Alternatively, post a comment by completing the form below:

Your email address will not be published. Required fields are marked *

Related Content

  • edge computing
    'Challenging Results' for MSPs in Channel Futures' Exclusive Quarterly Survey
  • White House
    White House Urges Companies to Take Ransomware Attacks More Seriously
  • Security shield on digital background
    VMware Security Connect Focused on Redefining Security, Increasing Threats
  • Fortune 500 2021 logo
    AT&T, Microsoft, Verizon, More Tech, Telco Companies Make Latest Fortune 500

Upcoming Events

View all

MSP Summit

September 13, 2022 - September 16, 2022

Channel Partners Conference & Expo

May 1, 2023 - May 4, 2023

Galleries

View all

Oracle Cloud & AT&T, AWS Lead Cloud News Roundup

August 12, 2022

Latest M&A: IBM, Vonage, Nokia, GoTo, Nitel, Ensono, Huntress, More

August 12, 2022

Partner Program Updates: Microsoft, TD Synnex, AppSmart, Cisco, Verizon

August 11, 2022

Industry Perspectives

View all

How to Take Shared Responsibility for Securing Cloud

August 11, 2022

Seize the Application Modernization Opportunity

August 2, 2022

A Growth Mindset: Your Organization’s Strategic Differentiator

August 1, 2022

Webinars

View all

Outsmarting RaaS: Implementation Strategies To Help Your Clients Before, During, and After a Ransomware Attack

August 23, 2022

Why it is Important to Upgrade Aging Servers and How to use Live Optics to Upgrade Efficiently

August 25, 2022

Executives at Home are Not Alright: An Intro to Digital Executive Protection

September 8, 2022

White Papers

View all

Work Goes Remote – (and Other Top ITOps Trends)

May 25, 2022

The New Bottom Line: How MSPs Can Meet the Healthcare Crisis While Evolving Their Businesses

April 19, 2022

How to build a Security Operations Center (on a budget)

April 4, 2022

Channel Futures TV

View all

ThreatLocker Preaches Zero Trust, Addresses Industry Competition

ScienceLogic Debuts New Partner Portal

August 9, 2022

Vonage a ‘Single Communications Stack Provider’ for Partners, Customers

June 27, 2022

IBM, Partners and the $1 Trillion Hybrid Cloud Opportunity

June 26, 2022

Twitter

ChannelFutures

Missed the news this week from @OracleCloud and @ATTBusiness? We've got it here. Plus, news from @AWSCloud and… twitter.com/i/web/status/1…

August 12, 2022
ChannelFutures

Huge channel-impacting acquisitions in the past month. We've got details on @IBM, @nokia, @GoTo, @EnsonoIT,… twitter.com/i/web/status/1…

August 12, 2022
ChannelFutures

Boost privacy by design with #shiftleft mindset and add #security to cloud deployments from start, says… twitter.com/i/web/status/1…

August 12, 2022
ChannelFutures

Say sayonara to contract renewals - @KaseyaCorp responds to mounting customer concerns with significant changes.… twitter.com/i/web/status/1…

August 11, 2022
ChannelFutures

.@Kyndryl, @Five9 partnership will focus on cloud-based #contactcenter solutions. dlvr.it/SWTFPx https://t.co/WGQedUjSB1

August 11, 2022
ChannelFutures

How cloud providers and customers can work together to safely share and secure responsibility in the cloud. @Cisco… twitter.com/i/web/status/1…

August 11, 2022
ChannelFutures

See the latest updates from @verizonbusiness, @GetNerdio, @AppSmartcom, @CiscoPartners and other companies.… twitter.com/i/web/status/1…

August 11, 2022
ChannelFutures

.@nutanix said to lay off 4% of workforce by October, as company cites macroeconomic issues. dlvr.it/SWSMDN https://t.co/w6JeqkI7r6

August 11, 2022

MSP 501

The industry's largest and most comprehensive partner awards program.

Newsletters and Updates

Sign up for The Channel Report, Channel Futures Update, MSP 501 Newsletter and more.

Live Channel Events

Get the latest information on the next industry-leading Channel Partners event.

Galleries

Educational slide shows and images from live events.

Media Kit And Advertising

Want to reach our audience? Access our media kit.

DISCOVER MORE FROM INFORMA TECH

  • Channel Partners Events
  • Telecoms.com
  • MSP 501
  • Black Hat
  • IoT World Today
  • Omdia

WORKING WITH US

  • Contact
  • About Us
  • Advertise
  • Newsletter

FOLLOW Channel Futures ON SOCIAL

  • Privacy
  • CCPA: “Do Not Sell My Data”
  • Cookie Policy
  • Terms
Copyright © 2022 Informa PLC. Informa PLC is registered in England and Wales with company number 8860726 whose registered and Head office is 5 Howick Place, London, SW1P 1WG.
This website uses cookies, including third party ones, to allow for analysis of how people use our website in order to improve your experience and our services. By continuing to use our website, you agree to the use of such cookies. Click here for more information on our Cookie Policy and Privacy Policy.
X