{"id":4838,"date":"2015-05-20T07:02:44","date_gmt":"2015-05-20T11:02:44","guid":{"rendered":"http:\/\/me-en.kaspersky.com\/blog\/?p=4838"},"modified":"2019-11-15T15:24:35","modified_gmt":"2019-11-15T11:24:35","slug":"venom-virtualization-vulnerability","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/venom-virtualization-vulnerability\/4838\/","title":{"rendered":"All you need to know about VENOM virtualization vulnerability"},"content":{"rendered":"

Much has been said about\u00a0the VENOM vulnerability<\/a>, the latest in an increasingly long line of bugs affecting vast swaths of the Internet. It\u2019s an old-school bug of the relatively new-age phenomena of Virtualization.<\/p>\n

Virtual machines are independently operational computers within computers. The so-called cloud is merely a vast network of virtual machines. An attacker could exploit VENOM in order to escape one virtualized environment and run code in another.<\/p>\n

Some of the more enthusiastic, or perhaps sensational, journalists have called VENOM more impactful than the now-infamous Heartbleed OpenSSL vulnerability. However, I think the best response came from noted security researcher,\u00a0Dan Kaminsky<\/a>.<\/p>\n

\u201cI think that we\u2019ve really lost something when we move to these linear rankings of bug versus bug,\u201d Kaminsky told Dennis Fisher on\u00a0Threatpost\u2019s Digital Underground podcast<\/a>. \u201cThis isn\u2019t Iron Man versus Captain America. This isn\u2019t the freaking Avengers; this is science.\u201d<\/p>\n

Such is the nature of the security industry today when every major bug is assigned a unique, hashtag-ready name, has it\u2019s own logo and a public relations team crowing it the worst vulnerability ever.<\/p>\n

\u201cBad bugs happen,\u201d Kaminsky explained later on in the podcast. \u201cThey\u2019re still bad, but we go ahead and deal with them\u2026 It was a big problem. We went ahead and we fixed it. Things were a lot worse; we privately went around and did everything we could on a private scale and now we\u2019re talking about it publicly to get the rest of the stuff. That\u2019s what we do. That\u2019s the game we play.\u201d<\/p>\n

\n

#VENOM<\/a> Flaw in #Virtualization<\/a> Software Could Lead to VM Escapes, Data Theft \u2013 https:\/\/t.co\/p2CXHhX6Gb<\/a><\/p>\n

\u2014 Threatpost (@threatpost) May 13, 2015<\/a><\/p><\/blockquote>\n