Oracle has released updates for its products to address the VENOM vulnerability impacting virtual environments.
VENOM was publicly disclosed last week. Its name stands for Virtualized Environment Neglected Operations Manipulation (VENOM). The bug resides in QEMU’s virtual Floppy Disk Controller, and is used in numerous virtualization platforms including Xen and the native QEMU client. The vulnerability was discovered by a researcher at CrowdStrike, and has existed since 2004.
The bug is agnostic of both the host and guest operating system. In order to exploit it, an attacker – or their malware -would need administrative or root privileges in the guest operating system. While there has been some discussion about comparing its severity to the Heartbleed bug, experts agree the VENOM vulnerability should be patched as soon as possible.
“Oracle has decided to issue this Security Alert based on a number of factors, including the potential impact of a successful exploitation of this vulnerability, the amount of detailed information publicly available about this flaw, and initial reports of exploit code already ‘in the wild’,” blogged Eric Maurice, software security assurance director at Oracle. “Oracle further recommends that customers apply the relevant fixes as soon as they become available.”
According to Oracle, Oracle Linux, Oracle Virtual Compute Appliance, Oracle VM and Oracle VM VirtualBox have updates to address the bug. However, the company also stated that the following products include QEMU but do not yet have updates available: Oracle Database Appliance, Oracle Exadata Database Machine, Oracle Exalogic Elastic Cloud and Oracle Exalytics In-Memory Machine.
“Oracle is investigating and will provide fixes for affected products as soon as they have been fully tested and determined to provide effective mitigation against this vulnerability,” according to Oracle’s advisory. “The product lists will be updated without additional emails being sent to customers and OTN Security Alerts subscribers. Thus, customers will need to check back for updates.”
Given its potential impact, VENOM can be big if an organization moves too slowly to address the threat, said Kapil Raina, a member of the Cloud Security Alliance’s Virtualization Working Group and head of product marketing at Elastica.
“The fact that it can be patched will limit the damage, but it will require an organization to schedule downtime and update their systems — not always possible immediately in every environment,” said Raina.
More from Brian Prince
- U.S. Healthcare Companies Hardest Hit by ‘Stegoloader’ Malware
- CryptoWall Ransomware Cost Victims More Than $18 Million Since April 2014: FBI
- New Adobe Flash Player Flaw Shares Similarities With Previous Vulnerability: Trend Micro
- Visibility Challenges Industrial Control System Security: Survey
- Adobe Flash Player Zero-Day Exploited in Attack Campaign
- Researchers Demonstrate Stealing Encryption Keys Via Radio
- Researchers Uncover Critical RubyGems Vulnerabilities
- NSA, GCHQ Linked to Efforts to Compromise Antivirus Vendors: Report
Latest News
- Google Shells Out $600,000 for OSS-Fuzz Project Integrations
- F5 BIG-IP Vulnerability Can Lead to DoS, Code Execution
- Flaw in Cisco Industrial Appliances Allows Malicious Code to Persist Across Reboots
- UK Car Retailer Arnold Clark Hit by Ransomware
- Dealing With the Carcinization of Security
- HeadCrab Botnet Ensnares 1,200 Redis Servers for Cryptomining
- Cyber Insights 2023 | Supply Chain Security
- Cyber Insights 2023 | Regulations
