Archive for VMWare

VMware Related Zero Day Has Been Exploited By Threat Actors For A Year…. Wow!

Posted in Commentary with tags on October 1, 2025 by itnerd

Broadcom has patched a high-severity VMware vulnerability (CVE-2025-41244, CVSS 7.8) that had been exploited as a zero-day for nearly a year. The flaw, impacting VMware Aria Operations and VMware Tools (including open-vm-tools on Linux), allows privilege escalation to root on VMs. Security researchers at NVISO Labs reported that a Chinese state-sponsored threat group, UNC5174, has been actively exploiting the bug, including by staging malicious binaries in writable directories like /tmp/httpd.  Patches are now available across VMware Cloud Foundation, vSphere, Aria Operations, Telco Cloud Platform, VMware Tools, and open-vm-tools (to be distributed by Linux vendors). Detection requires monitoring for uncommon child processes or leftover collector scripts.

You can find more details here: https://blog.nviso.eu/2025/09/29/you-name-it-vmware-elevates-it-cve-2025-41244/

Gunter Ollmann, CTO, Cobalt had this comment:

“Zero-days that persist in widely used infrastructure for nearly a year highlight the growing mismatch between vendor disclosures and adversary realities. In this case, the triviality of the exploit means it likely fell into the hands of multiple threat actors, not just those with nation-state capabilities. When exploitation is both simple and widespread, leaving customers unaware is an unforced error that adds unnecessary risk. The industry needs more candor around zero-day exploitation so defenders can calibrate their urgency. In the long run, trust in security advisories will matter as much as the patches themselves.”

Dale Hoak, CISO, RegScale adds this:

“An unpatched or undisclosed zero-day undermines the very foundation of compliance programs, which rely on accurate risk data. If customers don’t know an exploit is active, they can’t prioritize remediation, leaving regulators and auditors working from a false baseline of assurance. This is why it’s critical to operationalize risk in the larger context of patching—moving beyond a checklist exercise to a process that connects advisories, vulnerability data, and remediation actions in real time. Continuous controls monitoring enables that connection, ensuring that controls are validated against live threats, not just documented in static reports. Real assurance comes when organizations can align compliance, risk, and patching as a single operational discipline.”

While I am a big believer in patching all the things, you also have to have an approach to security that mitigates the potential effects of zero days. That’s not easy to do, but it has become a requirement given how quickly threat actors evolve and shift tactics.

I should also mention that the fact that this was out there for a year is bad. Extraordinarily bad. But you knew that already.

UPDATE: Adrian Culley, Senior Sales Engineer at SafeBreach adds this comment:

“Broadcom has released fixes for CVE-2025-41244 and related issues affecting VMware Aria Operations and VMware Tools. In certain configurations, VMs with VMware Tools managed by Aria Operations with SDMP enabled local privilege escalation to root. NVISO reports the bug was exploited in the wild since mid-October 2024 by a China-nexus actor assessed as UNC5174. Teams should patch Aria Operations/Tools immediately and ensure Linux hosts receive updated open-vm-tools from their distributors. Hunt for exploitation by looking for mimicked system binaries (e.g., httpd) in writable paths like /tmp/httpd and for unusual child processes from discovery collectors. After patching, continuously validate that privilege-escalation, credential harvesting, and lateral-movement paths are closed—don’t just assume they are.”

VMware Now Offering Workstation Pro And Fusion Pro For Free

Posted in Commentary with tags on May 14, 2024 by itnerd

A few days ago, I wrote about my use of virtual machines and I mentioned this:

Now, earlier on I did mention that I currently run two virtual machine software. That’s going to change as I am going to migrate to UTM for all my virtual machines. I’m doing that because since VMware has been acquired by Broadcom, their level of support has nosedived. You can take a scroll through the VMware Sub-Reddit to see the complaints about this acquisition that people have. And a lot of my clients are looking to move their enterprise level virtual machines off of the VMware platform for greener pastures like Microsoft Hyper-V, Nutanix or Citrix as a result of the chaos caused by the Broadcom acquisition. That lessens my need to run VMware’s software. Also UTM has much broader support for classic operating systems such as Windows XP and Windows 7. Which is something that VMware doesn’t offer. Thus it makes sense for me to transition to UTM. 

Well I may be rethinking this move because The Register is reporting that VMware or more accurately Broadcom who owns VMware now is going to offer Workstation Pro for PC and Fusion Pro for Mac are now going to be offered for free… For personal use. Now part of me thinks that this is a trap as this is an honour system. Meaning that if you’re some kid in their college dorm, Broadcom won’t care. But some company will likely play fast and loose with this and I can see Broadcom doing an audit and catching out a company on this front. I’m thinking this because the acquisition of VMware by Broadcom has been a clown show.

Anyway, the transition from the VMware customer portal to the Broadcom version is something that’s currently ongoing and is scheduled to end today. Assuming that happens on schedule, which given that this whole acquisition has been a clown show as mentioned previously I question if that is going be the case, I’ll be able to get a license key and test out Fusion Pro. Then I will be able to make a call as to if I should move to UTM. Right now I can’t see any of my VMware license keys in the customer portal, and I can’t make new ones to get Fusion Pro working. But let’s see if that changes.

UPDATE: Here’s the official announcement from VMware/Broadcom

UPDATE #2: I just got a chance to try updating to version 13.5.2 of VMware Fusion. It didn’t work and I am still stuck on VMware Fusion Player. I did some checking around and I found this post from the Product Manager of VMware Fusion Michael Roy who states that he is coming up with details on how to convert to Fusion Pro if you have Fusion Player installed. But the linked post walks you through how to install Fusion Pro as a new user.

UPDATE #3: I now have the Pro version of VMware Fusion installed. What I did is use a utility called AppCleaner to get rid of the current install of VMware Fusion Player. Then I downloaded version 13.5.2 from the Broadcom site and installed it. When you do that, you get the option to use the Pro version for personal use after the install is finished. This is pretty dumb as I should not have to delete the app to get this to work. It should simply work via an upgrade to 13.5.2. Clearly VMware or likely Broadcom didn’t have this scenario in their test plans. In any case, you won’t lose any of your virtual machines by doing this. Though you will have to go to File –> Scan For Virtual Machines to add them back.

VMware To Kill The Free Version Of vSphere Hypervisor… Here’s Why That’s A Stupid Move By Broadcom

Posted in Commentary with tags on February 13, 2024 by itnerd

Before I get to what’s in the title above. Some background. Last year VMware was sold to Broadcom for at ton of money. Then the first hint that Broadcom was going try to milk every last cent out of VMware that they could was that they took VMware accounts direct with next to zero notice and they terminated VMware’s partner program. All of that made it clear that things with VMware were changing, and not for the better. Today adds another piece to that puzzle with news that the free version of vSphere Hypervisor is being killed:

VMware vSphere Hypervisor (free edition) is no longer available on the VMware website

And:

Along with the termination of perpetual licensing, Broadcom has also decided to discontinue the Free ESXi Hypervisor, marking it as EOGA (End of General Availability).

Regrettably, there is currently no substitute product offered. For further details regarding the affected products and this change, we encourage you to review the following blog post: https://blogs.vmware.com/cloud-foundation/2024/01/22/vmware-end-of-availability-of-perpetual-licensing-and-saas-services/

What this basically means is that Broadcom has pretty much signaled that it is no longer interested in smaller VMware customers. Not only that, the free version was a way for people to become familiar with VMware, especially early in their career. Because once they had them using VMware for free, they’d happily pay for it when they were in a position to recommend it. Now VMware is effectively saying F-U to all those people and the potential revenue that comes from those people. Albeit delayed. And I’m pretty sure that this is going to come back to bite Broadcom at some point and is quite literally a gift from heaven for companies like Nutanix, Scale Computing or Microsoft. Sales reps in those companies must be run off their feet by VMware customers who want to switch to something else other than VMware.

Mark my words, Broadcom has made a major mistake by doing this.

Trend Micro Discovers Linux Based Malware That Targets VMware Servers

Posted in Commentary with tags , on May 29, 2022 by itnerd

Bad news for those who run VMware, as if they needed any more bad news that’s VMware related. Researchers at Trend Micro have discovered a Linux based malware that targets VMware ESXi servers:

We recently observed multiple Linux-based ransomware detections that malicious actors launched to target VMware ESXi servers, a bare-metal hypervisor for creating and running several virtual machines (VMs) that share the same hard drive storage. We encountered Cheerscrypt, a new ransomware family, that has been targeting a customer’s ESXi server used to manage VMware files.

Here’s why this is dangerous. It makes the job of ransomware attackers far easier because they can encrypt the VMware ESXi server and then encrypt every guest VM it contains. In effect it’s one shot pwnage for a threat actor. And that can be catastrophic for an enterprise. There’s really no specific mitigation strategies that are offered up by Trend Micro, but I have one. Have multiple backups and snapshots and store them off line so that they can’t get pwned. Also do regular test recoveries because Backus mean nothing if you can’t use them to recover from something like this.

VMware Vulnerability Inner Workings Shown In Horizon3.ai “Deep Dive”

Posted in Commentary with tags , on May 26, 2022 by itnerd

Horizon3.ai has just published VMware Authentication Bypass Vulnerability (CVE-2022-22972) Technical Deep Dive. The detailed analysis of the inner workings of a critical authentication bypass vulnerability in VMware Workspace ONE Access, Identity Manager and vRealize Automation products (CVE-2022-22972). This vulnerability allows an attacker to login as any known local user.

Horizon3.ai Exploit Developer James Horseman notes in his summary: “CVE-2022-22972 is a relatively simple Host header manipulation vulnerability. Motivated attackers would not have a hard time developing an exploit for this vulnerability.” Horseman cites results of a Shodan.io search indicating “the healthcare, education industry, and state government sectors all seem to be a fair amount of the types of organizations that have exposures – putting them at larger risk for current and future exploitation.”

If you haven’t done so already, you should apply the updates that are available to mitigate this vulnerability.

The list of affected products are: 

  • VMware Workspace ONE Access (Access)
  • VMware Identity Manager (vIDM)
  • VMware vRealize Automation (vRA)
  • VMware Cloud Foundation
  • vRealize Suite Lifecycle Manager

There is also a workaround detailed here for those who can’t patch all the things immediately.

Horizon3.ai Reproduces A Critical VMware Vulnerability That Grants Administrative Access

Posted in Commentary with tags , on May 24, 2022 by itnerd

The attack team at Horizon3.ai has successfully reproduced CVE-2022-22972 affecting multiple VMware products. The vulnerability allows malicious actors to gain administrative access to VMware Workspace ONE Access, Identity Manager and vRealize Automation. The fact that this was reproduced by Horizon3.ai is good for Horizon3.ai, but bad for anyone using the affected products as that means that threat actors can do the same. Then they can weaponize this.

Zach Hanley, Chief Attack Engineer, Horizon3.ai:

“Last week VMware released VMware Security Advisory – 0014 which details a critical vulnerability, CVE-2022-22972, which allows a remote attacker to bypass authentication for VMware Workspace ONE, vIDM, and vRA. This vulnerability can lead to attackers gaining administrative rights on the VMware applications and may also lead to root level access on the appliances if chained with CVE-2022-22973. 

“Coinciding with VMware’s security advisory, CISA announced an Emergency Directive mandating that all government agencies patch or mitigate affected products by May 23, 2022. This 5 day remediation window was deemed necessary given the critical nature of the applications and rapid weaponization of previous CVEs. Currently, no other proof-of-concepts have been announced and no reports of in-the-wild exploitation have been noted by threat intelligence organizations. 

“A quick search on Shodan.io for the affected VMware applications returns a pretty low count of organizations that expose them to the internet. Of note, the healthcare, education industry, and state government all seem to be a fair amount of the types of organizations that have exposures – putting them at larger risk for current and future exploitation.

“Organizations should address these issues by immediately following the guidance within the VMware Security Advisory. 

“We will likely be releasing the technical details at the end of this week. The technical details will include analyzing the patch to understand how an attacker may have previously abused this code path.

“Given that it took us about a week to develop a PoC, we fully expect motivated attackers to have already developed a PoC and began exploiting it. We also plan on releasing a minimal PoC at the same time.”

This issue received a fix last Wednesday as described above. I strongly advise that if you are running the affected VMware products, that you patch everything immediately if you haven’t already. The list of affected products are:

  • VMware Workspace ONE Access (Access)
  • VMware Identity Manager (vIDM)
  • VMware vRealize Automation (vRA)
  • VMware Cloud Foundation
  • vRealize Suite Lifecycle Manager

There is also a workaround detailed here for those who can’t patch all the things immediately.

Prophet Spider Is Exploiting Log4j Vulnerabilities In VMware Horizon

Posted in Commentary with tags , on January 26, 2022 by itnerd

Initial access broker group Prophet Spider has been found exploiting the Log4j vulnerability in VMware Horizon, according to a new report from researchers with BlackBerry Research & Intelligence and Incident Response teams. Given how widely used VMware Horizon is used, this is a major threat.

Jorge Orchilles, CTO, SCYTHE had this to say:

“Initial Access Brokers leverage any opportunity to gain access to an organization. They must maintain that access as they sell it and hand it off to the buyer. Today the exploit being used is for Log4j, tomorrow it will be another. As defenders, we want to be able to detect and respond to the inevitable exploit that will one day break through our protection. Regardless of the exploit, we can detect and respond to what happens after by testing, training, and improving our people, process, and security controls. This is an ever evolving field, we must collaborate to stay ahead of the threats.”

This is the key thing:

The exact number of applications (and the various versions) affected by these vulnerabilities may never be fully known. Although VMware released a patch and mitigation guidance in December 2021 in response to the vulnerability, many implementations remain unpatched, leaving them susceptible to exploitation.

Thus if you haven’t got about patching, you may want to hop to it ASAP seeing as this is being exploited.

Smart Technology Makes The New Istanbul Airport Intelligent & Efficient Thanks To Cisco, Microfocus, DellEmc, Hitachi & Vmware

Posted in Commentary with tags , , , , on October 18, 2019 by itnerd

This slideshow requires JavaScript.

Smart technology is dramatically changing the way airports are run and enhancing the passenger experience.

The newly opened Istanbul Airport, the hub for the ever-expanding Turkish Airlines, unveiled earlier this year, covers 76 million square meters or 18,780 acres. Once complete, it will be able to handle 200 million passengers a year and be the biggest airport by passenger traffic (by comparison, Hartsfield-Jackson International in Atlanta, is currently the busiest airport with 107 million passengers a year).

Behind the success of this airport, in large part, is technology developed with industry leaders such as Cisco, Microfocus, DellEmc, Hitachi and Vmware.

Here are some highlights:

New systems:

  • This airport is the first TIER 3 intelligent Airport Data Center in the world, certified by Uptime Institute, the global data center authority.
  • An Airport Collaborative Decision Making system has been implemented, where stakeholders in the aviation sector (airport operators, airlines, ground handling companies, state authorities) can share the data they have and allow for more accurate decisions by looking at the same operational picture.
  • A level-4 Airport Surface Movement and Guidance Control System has been implemented to help keep airport ground operations safe and fast, especially at low visibility conditions.
  • A biometric integrated passport control system was developed in coordination with Turkish Police IT Department. The system is capable of validating passengers who hold a Turkish Passport, by using fingerprint and face recognition biometric features.
  • A new system called the Passenger Flow Monitoring (PFM) will monitor passenger flow through various checkpoints such as passport control in order to segregate land side/airside passage. This will allow passengers to be directed in a more intelligent manner.
  • A technology driven bag-drop system enables passengers to check-in their luggage quickly and easily. Having checked in online or at the airport kiosks, passengers weigh their bags and use their boarding pass at the self-bag-tag kiosk located in the airport terminal to generate a label for their bag.
  • Waiting time at baggage carousels will be shortened. The 42 kilometers long baggage system, holding the capacity to process over 28,880 pieces of luggage per hour, ensures an uninterrupted passenger experience by bringing down the baggage waiting period to a minimum level.
  • The EBS system (early baggage storage system) with a capacity of 10,800 pieces of luggage makes it possible to store early arriving baggage, thereby making Istanbul Airport use the latest baggage store technology.

Artificial intelligence:

  • Biometric screening and advanced passport control has been integrated to help passengers check in quicker.
  • A range of software has been developed from mobile applications to boost airport security systems to an airline messaging platform and a joint decision-making system.
  • The airport is also working on the first airport data center in the world, the first virtual tower application in Turkey, domestic robots and unmanned passenger transfer vehicles.

Robotics:

Istanbul Airport will have Humanoid Infotainment Robots to:

  • Meet and greet passengers and offer general information about the Airport with audio-visual guidance
  • Provide passengers, using their boarding pass, specific information about flight status, gate numbers, check-in desks, etc.

 

Review: VMware Fusion 11

Posted in Products with tags on October 18, 2018 by itnerd

VMware has released VMware Fusion 11 which is the latest version of their virtualization product for macOS in the last couple of weeks. Last year’s VMware Fusion 10 impressed me so much that I switched to it from Parallels Desktop as my personal choice for virtualization on my Mac. Thus I was very interested to see what VMware brought to the table in version 11.

Let me get straight to the point. If you’re looking for a bunch of new and cool features, you’re not going to see that here. And that’s not a bad thing as from what I can tell, VMware Fusion 11 is meant to enhance what was already a solid platform and bring it in line with other VMware virtualization offerings. And that’s not a bad thing as one strength that VMware Fusion has is that it can pull from their other virtualization offerings to make itself better for Mac users. Plus you can integrate VMware Fusion into a larger VMware environment with ease as it fully supports that use case with ease. Having said that it does have a bunch of improvements which include the following:

  • macOS Mojave compatibility
  • Support for the iMac Pro and MacBook Pro models. Including TouchBar support.
  • Support for Windows 10 1803, Ubuntu 18.04, macOS 10.14, Fedora 28, RHEL 7.5, CentOS 7.5, Debian 9.5, OpenSuse Leap 15.0, FreeBSD 11.2, ESXi 6.7
  • Support for Apple Metal and Microsoft Direct X 10.1
  • Security fixes and architectural changes have been made to mitigate threats like Spectre and Meltdown.
  • Support for virtual NVMe drives on Macs that have those drives.

The last item is particularly interesting as NVMe drives offer performance advantages over regular SATA drives. Thus if your Mac has an NVMe drive in it, this will make your VMs run significantly faster. The second last item was a chief motivator for me to move to VMware Fusion last year as my previous virtualization product didn’t offer those fixes.  Support for Metal is great because that is another way that VMware has increased the performance of the product. And while I welcome support for Direct X 10.1, support for Direct X 11 or 12 would be most welcome for the game players out there. Other than that,   I did notice some improvements from a disk and graphics perspective after I upgraded and started testing my VMs.

One really cool feature is that VMware Fusion 11 includes an Applications Menu which sits in the Mac’s main Menu Bar at the top of the screen for easy access. This menu allows you to quickly browse and select your VMs and also to control individual VMs even when they’re not running. The menu can be used to start, shut down or pause a VM, or to switch viewing modes on the Mac desktop. It’s really handy.

Here’s the bottom line. This is an evolutionary upgrade that will appeal to a variety of users. Whether you are a home user or an enterprise that runs other VMware products, there’s value in upgrading to VMware Fusion 11. It is available starting at $79.99 USD for new customers and $49.99 USD as an upgrade. And don’t forget there is a Pro version which is $159.99 USD for new customers and $119 USD as an upgrade.

 

VMware Advances Networking for the Digital Era with the Virtual Cloud Network

Posted in Commentary with tags on May 1, 2018 by itnerd

VMware today outlined its vision for the future of networking, and unveiled the Virtual Cloud Network. The Virtual Cloud Network will enable organizations to create a digital business fabric for connecting and securing applications, data, and users across the entire network in a hyper-distributed world.

To deliver on this vision, VMware announced the VMware NSX networking and security portfolio to enable consistent, pervasive connectivity and security for apps and data across software-defined data centre, branch, cloud, and telco environments. Global leaders in digital transformation and technology innovation demonstrated support for VMware’s vision and NSX portfolio launch (see below).

The NSX portfolio includes investments of resources to deliver new capabilities that include:

  • VMware NSX SD-WAN integration with VMware NSX Data Center and VMware NSX Cloud
  • NSX Cloud support for applications running in Microsoft Azure
  • NSX Data Center support for containerized cloud-native and bare metal applications
  • Telco/NFV and networking performance optimizations for distributed workloads in NSX Data Center

Virtual Cloud Network: A New Network Approach for the Next 20 Years

Organizations are embarking on digital transformation to create better experiences for customers, clients, and employees, and drive better business outcomes. These efforts introduce a new level of networking and security complexity as organizations move from centralized data centres, to hyper distributed applications and centres of data at the edge.

The Virtual Cloud Network will enable businesses to connect, better secure, and optimize the delivery of applications and data in an era when a majority of workloads exist outside the data centre. With a Virtual Cloud Network, customers will be able to create an end-to-end software-based network architecture that can deliver services to applications and data, wherever they are located. The Virtual Cloud Network will operate at global scale from edge to edge, and deliver consistent, pervasive connectivity and security for apps and data independent of underlying physical infrastructure or location. The Virtual Cloud Network will enable organizations to streamline the journey to digital business, and take full advantage of digital transformation, by unlocking value from today’s current networking technologies and significantly reducing network complexity.

VMware Advances Business Transformation with Networking and Security in Software

The VMware NSX networking and security portfolio provides a common operating environment to connect, secure and operate a Virtual Cloud Network. The portfolio will include new and enhanced capabilities for data centre, branch, cloud and telco environments, and will advance support for traditional and modern application frameworks. With the VMware NSX portfolio, customers will be able to manage consistent networking and security across private data centres, AWS, Azure, and IBM Cloud.

Network Virtualization: VMware NSX Data Center is the industry’s most widely deployed network virtualization platform for the enterprise data centre, adopted by more than 4,500 customers globally. NSX Data Center enables customers to design, build, and operate next-generation policy driven data centres that connect, secure, and automate traditional and modern applications, and help protect applications and data through security that is an intrinsic part of the infrastructure.

With the latest update, NSX Data Center will include new container and bare metal capabilities that will be able to provide consistent networking services to all applications and deployment models. Container integration rapid-releases will enable global security and more to new app platforms (e.g. PKS). VMware is also adding new accelerated performance optimizations for distributed workloads, which will better support telco/network functions virtualization environments.

Software-Defined Wide Area Networking (SD-WAN): VMware NSX SD-WAN by VeloCloud is the industry-leading SD-WAN solution that combines the economics and flexibility of the best real-time network overlay with the deployment speed, scale and automation of cloud-delivered services. With NSX SD-WAN, customers can deliver better cloud and application performance with full visibility, metrics, control, and automation of all device and user endpoints, with lower overall costs. NSX SD-WAN integrates with NSX Data Center and NSX Cloud, enabling customers to extend consistent networking and security policies from the data centre to the branch to the cloud, while providing operational visibility and control end-to-end. NSX SD-WAN by VeloCloud provides an extensible platform for enterprises and telcos to integrate both on-premises and cloud services under the same consistent business policy framework. NSX SD-WAN is available to customers in three ways. Customers can purchase NSX SD-WAN as a service from VMware, or from more than 60 communication service providers worldwide. NSX SD-WAN is also available as an on-premises deployable solution. More than 2,000 customers have adopted NSX SD-WAN to date.

  • Multi-Cloud Networking: VMware NSX Cloud provides consistent networking and security for applications running in both private VMware-based data centres and natively in public clouds. NSX Cloud addresses operational challenges inherent with using multiple public clouds, such as inconsistent policies and constructs across clouds; manual operations requiring policy for each cloud, region, and VPC: limited operational visibility into East-West traffic; and operations tools that are specific to each public cloud.

With the latest release of NSX Cloud, VMware will add new native controls for customers that are using Microsoft Azure as part of their multi-cloud strategy.

  • Hybrid Cloud Connectivity: VMware NSX Hybrid Connect enables customers to solve one of the biggest challenges with hybrid cloud – consistent networking. VMware NSX Hybrid Connect enables customers to create a consistent, highly performant, and more secure software fabric that interconnects data centres and clouds while maintaining the same governance and control. With NSX Hybrid Connect, customers can seamlessly migrate workloads from any VMware environment to a modern software-defined data centre environment running anywhere — on-premises, in the public cloud, or operated by a VMware Cloud Provider partner.

Additional Resources