IBM Security Bulletin: VMware security issues that affect IBM CloudBurst

Share this post:

CVE-2014-1207
VMware ESXi and ESX are vulnerable to a denial of service that is caused by a NULL pointer dereference when handling Network File Copy (NFC) traffic. By intercepting and modifying the NFC traffic between ESXi/ESX and the client, an attacker could exploit this vulnerability to cause a denial of service.

CVE-2014-1208
VMware ESXi and ESX are vulnerable to a denial of service that is caused by the improper handling of invalid ports. A local attacker could exploit this vulnerability to cause the VMX process to fail.

CVE-2014-1211
VMware vCloud Director is vulnerable to cross-site request forgery that is caused by improper validation of user-supplied input by the Hyper Text Transfer Protocol (http) session management. It persuades an authenticated user to visit a malicious Web

CVE(s):CVE-2014-1207, CVE-2014-1208 and CVE-2014-1211

Affected product(s) and affected version(s):

IBM CloudBurst 1.2, 2.0, 2.1

Refer to the following reference URLs for remediation and additional vulnerability details:
Source Bulletin: http://www-01.ibm.com/support/docview.wss?uid=swg21669248
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/90559
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/90558
X-Force Database: https://exchange.xforce.ibmcloud.com/vulnerabilities/90560

More stories

IBM Product Security Incident Response

Acknowledgement

May 20, 2020 9:00 am EDT

IBM acknowledges and thanks the security researchers and organizations listed below for reporting and working with us to resolve one or more security vulnerabilities in our products and services. Disclosures for 2021 Keith Lee Credit to Hassan Raza Disclosures for 2020 Honggang Ren of Fortinet’s FortiGuard Labs Pawel Gocyla, (ING Tech Poland) Dries Eestermans, (nynox-dries) ...read more


A new and advanced Rowhammer-based attack on DDR4 memory

Mar 11, 2020 8:59 am EDT

A new and advanced Rowhammer-based attack on DDR4 memory was announced on March 10, 2020. (CVE-2020-10255) The attack has been shown to cause memory corruption in lab environments. Vulnerability exploitation on IBM Power processor architectures, IBM Z-based architectures, IBM Cloud and IBM storage products would be difficult. No customer actions are currently required. IBM Power ...read more


XSA-353 Security Vulnerabilities

Nov 13, 2019 12:30 pm EST

Security vulnerability CVE-2020-29479 could potentially enable a denial of service attack or allow unauthorized access to the hypervisor, and is addressed by Citrix in XSA-353 security advisories. IBM Cloud has worked with its technology partners to deploy mitigation and remediation measures. There is no known malicious exploit of this vulnerability at this time. ...read more