VENOM Vulnerability

VENOM Virtualized Environment Neglected Operations Manipulation Discovered by Jason Geffner, CrowdStrike Senior Security Researcher _____________________ Vendor advisories, patches, and notifications available below in Q&A section. VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code used by many computer virtualization platforms. This vulnerability may allow an attac

[akulog]

Venom – A security vulnerability in virtual floppy drive code

[d-kotani]

"even if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active" これが見逃されてそうで怖い & VM を他のホストに移動してから update すればよいので VM の停止は必要なさそう

[yujiorama]

QEMU

[syuu1228]

“VENOM, CVE-2015-3456, is a security vulnerability in the virtual floppy drive code”

[koyhoge]

仮想マシンのフロッピードライブのコードに脆弱性があったそう。でもどうやったらゲスト上のWebサーバからそこにアタックできるんだろう?