 |
 |
Hi everyone: I was talking to some collegues at lunch, and a conversation about virtualization came up. I had just read the SANS NewsBites, and found an interesting story about the latest round of Microsoft patches. In the editor's comments there was an interesting point about virtualization. This article reads: --Microsoft Fixes 14 Flaws on Patch Tuesday 15 August 2007 This month's patch Tuesday from Microsoft saw the biggest security update since February of this year. Tuesday's update saw 9 security bulletins issued addressing 14 vulnerabilities. Eight of the fixes were rated as critical, the highest risk rating given by Microsoft for its patches. Four bulletins were released for Windows 2000, five for Windows XP and two for Vista. Other products affected included Internet Explorer and Microsoft Excel. http://www.computerworld.com/action/article.do?command=printArticleBasic &articleId=9030696 http://www.smh.com.au/news/security/microsoft-issues-six-critical-ptches /2007/08/15/1186857572390.html http://www.vnunet.com/vnunet/news/2196636/microsoft-patches-critical [Editor's Note (Skoudis): I'd like to draw your attention to MS07-049. This patch for Virtual PC and Virtual Server fixes a heap overflow vulnerability that, according to Microsoft, "Could allow a user with administrator permissions to the guest operating system to run code on the host operating system or other guest operating systems." That's a textbook definition of VM escape. For years, many very bright folks have told me that VM escape is impossible. Folks, it is possible. How can you cope? First, harden your guest machines. Next, patch your VM software just as diligently as you patch your OSs. Then, on critical VMs with sensitive data, disable any ease of use features, such as drag and drop, file sharing, and cut and paste. Finally, plan your VM deployment carefully, assuming that VM escape is a possibility. Put strong guests with sensitive data on one underlying host, and weak machines without sensitive data on another underlying host. Don't mix and match.] I have heard many things that could put a damper on virtualization, but the biggest could be "VM escape". Are there any opinions on campus as to the implications of this revelation? +-------------------------------------------+ | Michael Surato | | College of Arts and Letters | | Michigan State University | | 320 Linton Hall | | East Lansing, MI 48824 | | Voice: (517) 353-0778 Fax: (517) 355-0159 | +-------------------------------------------+