Linux Variant of HelloKitty Ransomware Targets VMware ESXi Servers

For the first time, researchers have publicly spotted a Linux encryptor used by the HelloKitty ransomware gang: the outfit behind the February attack on videogame developer CD Projekt Red. On Wednesday, MalwareHunterTeam disclosed its discovery of numerous Linux ELF-64 versions of the HelloKitty...

ESXi 6.5 / 6.7 / 7.0 Multiple Vulnerabilities (VMSA-2021-0014)

The remote VMware ESXi host is version 6.5, 6.7 or 7.0 and is affected by multiple vulnerabilities: - SFCB Small Footprint CIM Broker as used in ESXi has an authentication bypass vulnerability. A malicious actor with network access to port 5989 on ESXi may exploit this issue to bypass SFCB...

VMware ESXi 缓冲区错误漏洞

VMware ESXi is a server virtualization platform from VMware that can be installed directly on physical servers. A buffer error vulnerability exists in VMware ESXi, which originates from an out-of-bounds read of heap memory by OpenSLP in the product, which can be triggered by malicious access on...

Linux Variant of REvil Ransomware Targets VMware’s ESXi, NAS Devices

UPDATE Cybercriminals behind a string of high-profile ransomware attacks, including one extorting $11 million from JBS Foods last month, have ported their malware code to the Linux operating system. The unusual move is an attempt to target VMware’s ESXi virtual machine management software and...

VMware ESXi OpenSLP Heap Overflow Exploit

Proof of concept exploit for the OpenSLP heap overflow in VMware ESXi versions 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, and 6.5 before ESXi650-202102101-SG. !/usr/bin/python3 CVE-2021-21974 PoC Exploit By: Johnny Yu @staightblast Tested against: 1 VMware ESXi 6.7.0...

VMware ESXi OpenSLP Heap Overflow

!/usr/bin/python3 CVE-2021-21974 PoC Exploit By: Johnny Yu @staightblast Tested against: 1 VMware ESXi 6.7.0 build-14320388 ; VMware ESXi 6.7.0 Update 3 2 VMware ESXi 6.7.0 build-16316930 ; VMware ESXi 6.7.0 Update 3 import sys import time import trace import queue import struct import socket...

ESXi OpenSLP堆溢出漏洞（CVE-2021-21974）

My RCE PoC walkthrough for CVE-2021–21974 VMware ESXi OpenSLP heap-overflow vulnerability Introduction During a recent engagement, I discovered a machine that is running VMware ESXi 6.7.0. Upon inspecting any known vulnerabilities associated with this version of the software, I identified it may ...

Threat spotlight: DarkSide, the ransomware used in the Colonial Pipeline attack

Late last week, the business network systems of Colonial Pipeline, the biggest supplier of fuels on the East Coast of the United States, were compromised due to a ransomware attack, forcing the company to temporarily shut down its operations while investigations are underway. Monday morning,...

PYSEC-2021-74

In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers in the vmware.py files does not always validate the SSL/TLS certificate...

CVE-2021-21974

OpenSLP as used in ESXi 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue i...

CVE-2021-21974

OpenSLP as used in ESXi 7.0 before ESXi70U1c-17325551, 6.7 before ESXi670-202102401-SG, 6.5 before ESXi650-202102101-SG has a heap-overflow vulnerability. A malicious actor residing within the same network segment as ESXi who has access to port 427 may be able to trigger the heap-overflow issue i...

VMware ESXi OpenSLP Heap Overflow Vulnerability

VMware ESXi is VMware's open server resource consolidation platform that enables centralized management of multiple servers with less hardware and improved server performance and security. VMware ESXi OpenSLP Heap Overflow Vulnerability.The VMware ESXi OpenSLP heap overflow vulnerability is...

VMware ESXi SLP Heap-based Buffer Overflow Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of VMware ESXi. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of SLP messages. The issue results from the lack of proper validati...

PT-2021-2129

Name of the Vulnerable Software and Affected Versions: VMware ESXi versions 6.5 before ESXi650-202102101-SG VMware ESXi versions 6.7 before ESXi670-202102401-SG VMware ESXi versions 7.0 before ESXi70U1c-17325551 Description: VMware ESXi’s OpenSLP service contains a heap-overflow vulnerability. An...

The vulnerability of VMware ESXi, VMware Workstation, VMware Fusion, and VMware Cloud Foundation, related to the manipulation of the zero pointer, allows a malicious actor to trigger a service failure.

The vulnerabilities of VMware ESXi, VMware Workstation, VMware Fusion, and VMware Cloud Foundation are related to the handling of the zero pointer. Exploiting these vulnerabilities can allow attackers to trigger service failures...

CVE-2020-3999

VMware ESXi 7.0 prior to ESXi70U1c-17325551, VMware Workstation 16.x prior to 16.0 and 15.x prior to 15.5.7, VMware Fusion 12.x prior to 12.0 and 11.x prior to 11.5.7 and VMware Cloud Foundation contain a denial of service vulnerability due to improper input validation in GuestInfo. A malicious...

VMware ESXi and VMware Workstation Code Issue Vulnerability

Vmware VMware ESXi and VMware Workstation are both products of Vmware, Inc. VMware ESXi is a server virtualization platform that can be installed directly on physical servers.VMware Workstation is a set of virtual machine software. VMware ESXi is a server virtualization platform that can be...

The vulnerability of the XHCI interface of USB controllers in VMware ESXi, VMware Workstation, VMware Fusion, and the VMware Cloud Foundation virtualization platform allows a perpetrator to execute arbitrary code.

The vulnerability of the XHCI Extensible Host Controller Interface interface of USB controllers in VMware ESXi, VMware Workstation, VMware Fusion, and VMware Cloud Foundation virtualization platforms is related to the use of memory after release. Exploiting this vulnerability can allow an attacke...

VMware ESXi Elevation of Privilege Vulnerability

VMware ESXi is a virtualization software and the software supports windows platform to run. An elevation of privilege vulnerability exists in VMware ESXi. The vulnerability stems from an issue with how certain system calls are managed. An attacker with privileges only in the VMX process could...

VMSA-2020-0026 : VMware ESXi, Workstation and Fusion updates address use-after-free and privilege escalation vulnerabilities

a. Use-after-free vulnerability in XHCI USB controller CVE-2020-4004 VMware ESXi contains a use-after-free vulnerability in the XHCI USB controller. A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machines VMX proce...