• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

VMWare Source Code Leak?

I read about this the other day and the article I read said it only affected ESX and not ESXi, and VMWare is pushing ESXi and not ESX, it hopefully won't affect many people.
 
I was thinking more along the lines of enterprise/corp environments.
 
NetJunkie said:
We have had a customers ask us about it. There is concern.
Click to expand...

I presume VMWare knows what part of the source code was stolen, since they know the file that was posted. Correct?

And I'm making the presumption that the code that was stolen was not code that VMWare was already sharing?

Any more info that can be provided? Precautions to take and the like?

Not that all the machines can communicate to our vSphere environment since it's in a restricted VLAN, but it would be nice to know any info available.

But I'm going to guess that nothing can be said until (another) official statement is released?
 
We (partners..even really good ones) know nothing more than the official statement from VMware.
 
The documents in question date back to 2003 and 2004, he said.
Click to expand...

Think about what VMware software was out in 2003. Still using any of it? Didn't think so. :)
 
The software was used in 2003, and is even commented as from 1998 (I saw the leaked document). Bear in mind that it is one file, and very difficult to understand (move this register, move that register, etc). Also, bear in mind that ESX is a hypervisor running on RHEL. ESXi is totally stand-alone and runs as it's own kernel. There is a PR concern, but very little real security concern.
 
REDYOUCH said:
The software was used in 2003, and is even commented as from 1998 (I saw the leaked document). Bear in mind that it is one file, and very difficult to understand (move this register, move that register, etc). Also, bear in mind that ESX is a hypervisor running on RHEL. ESXi is totally stand-alone and runs as it's own kernel. There is a PR concern, but very little real security concern.
Click to expand...

even ESXi is a linux-like. this is just embedded style not a full-blown as ESX, unless vmware does not use linux-like on their current ESXi.

I believe that people will have concerns when they have been worked a long time on ESXi environment since the detail of ESXi is their awareness.

vmware need to going forward in PR, and release patches when needed.
 
cantalup said:
even ESXi is a linux-like. this is just embedded style not a full-blown as ESX, unless vmware does not use linux-like on their current ESXi.

I believe that people will have concerns when they have been worked a long time on ESXi environment since the detail of ESXi is their awareness.

vmware need to going forward in PR, and release patches when needed.
Click to expand...

ESX was a hypervisor running on top of the RHEL kernel. ESXi is it's own kernel.

http://kb.vmware.com/selfservice/mi...nguage=en_US&cmd=displayKC&externalId=1006543

And also, most people are not running ESX anymore (or hopefully soon they won't be), as it was decomissioned in vSphere 5.0.
 
REDYOUCH said:
The software was used in 2003, and is even commented as from 1998 (I saw the leaked document). Bear in mind that it is one file, and very difficult to understand (move this register, move that register, etc). Also, bear in mind that ESX is a hypervisor running on RHEL. ESXi is totally stand-alone and runs as it's own kernel. There is a PR concern, but very little real security concern.
Click to expand...

GOD NO.

It is NOT a hypervisor running on RHEL. It was back in the 2.0 days, in 2003, but it's not anymore. Not even close. In fact, as of 3.0, it wasn't - the rhel bits were a console VM, nothing more.

:mad:
/rageoff.
 
lopoetve said:
GOD NO.

It is NOT a hypervisor running on RHEL. It was back in the 2.0 days, in 2003, but it's not anymore. Not even close. In fact, as of 3.0, it wasn't - the rhel bits were a console VM, nothing more.

:mad:
/rageoff.
Click to expand...

In ESX the Linux kernel boots the VMWare components and then becomes the first virtual machine itself after everything is loaded. I was simply trying to indicate that the ESX version of the operating system is much more heavily integrated with Linux. On the other hand, ESXi boots on its own and uses BusyBox for all SC commands. This results in a much smaller footprint and decreased potential for vulnerabilities. Simply put, I highly doubt that this security breach will have much of an impact in well-built, enterprise environments of today.
 
REDYOUCH said:
In ESX the Linux kernel boots the VMWare components and then becomes the first virtual machine itself after everything is loaded. I was simply trying to indicate that the ESX version of the operating system is much more heavily integrated with Linux. On the other hand, ESXi boots on its own and uses BusyBox for all SC commands. This results in a much smaller footprint and decreased potential for vulnerabilities. Simply put, I highly doubt that this security breach will have much of an impact in well-built, enterprise environments of today.
Click to expand...

Also not entirely true.

A highly custom linux initrd (but only the initrd) bootstraps the vmkernel, which loads its modules, and then launches init inside of the initial VM (world 0) after reading a and does a switchroot into it.

The linux kernel itself never loads until the actual vmkernel is already up, as of 3.0. :) ESXi uses syslinux to kickstart the vmkernel (smaller footprint than a full classic initrd), and then busybox runs as world 0.

World 0 linux VMs have specific driver hooks into the main vmkernel for ESX Classic, but there's still not linux code running natively.
 
lopoetve said:
Think about what VMware software was out in 2003. Still using any of it? Didn't think so. :)
Click to expand...

Even some current Linux distros can have some very old code, right?

And considering VMWare hasn't exactly released much info other than code was stolen, how do we know whether or not that code is still in use?

Hence the question :)

Sure, for all I know, it's old/outdated/irrelevant code to current releases; but I don't know that, since those details haven't been released.
 
At this point I think we can assume that it's still current or semi-current code. That's completely my opinion with zero communication from VMware...but usually in cases like this if it was old code they'd be happily stating that...and they aren't. Again, my opinion.
 
Looks like (as I stated previously) this code does not apply to current environments...

Quote from VMWare:
The information that was released by a faction of Anonymous relates to antiquated code from ESX 3.0 in the 2003 time frame that is no longer included in any newer 64-bit versions of our products.
Click to expand...
 
REDYOUCH said:
Looks like (as I stated previously) this code does not apply to current environments...

Quote from VMWare:
Click to expand...

let the time will tells the truth whether some codes applied or not.

I believe, some old codes still applied to current environments.
it is impossible that the product lines does not share old codes where is still applicable on the current environment. Just my thought

I think, vmware will do some PR, since the news is already spreading out on net
 
aha... a good move.
vmware release security patches :D
I would assume some old codes are still existed in current vmware esxi product :D
 
cantalup said:
aha... a good move.
vmware release security patches :D
I would assume some old codes are still existed in current vmware esxi product :D
Click to expand...

Or maybe they're just releasing more security patches like they always do?
 
lopoetve said:
Or maybe they're just releasing more security patches like they always do?
Click to expand...

this is hard to tell, unless you are an insider :p

as my experience on software products, some products still use some old codes from previous product. do we need to re-invent the wheel again? ..
for example: time constrains, same functions, or other reasons.

I think, vmware PR is pretty good on handling leaked issue.

on my understanding, vmware release patches when they have to :D. we can see the time-span when vmware released patches, not many :). just my thought.


and Do Not forget to patch you esxi :D
 
You must log in or register to reply here.
Back
Top