VMware Security Advisory:- VMSA-2012-0001
Posted in Security on January 31st, 2012 by Tom Howarth – Be the first to commentBrand new Advisory regarding Third party updates,
Brand new Advisory regarding Third party updates,
Just a couple of advisories today, it’s been quiet in Palo Alto recently regarding these, but today we have a new one and this one which is a third time appearance for this particular update. This is quite a complex advisory with a lot going on in it, it covers a potential DOS in the SLPD daemon and another relating to bind, pan and rpm in ESX 4.0.
For those of us who have been in IT for a while doing work in Microsoft environments before will know all about the great tools that the guys at Sysinternals provide, many will remember being worried when they got bought by the big beast themselves and they became part of Microsoft, but they have continued to provide excellent value add in terms of both costed products under the Wininternals brand and the free tools that go out via the Sysinternals brand.
Sometimes it is a royal pain in the backside getting access to these tool’s as you have to navigate the SysInternals site and individually download each tool from their individual page.
Now they have come to the rescue of us all and provided a new way of downloading them especially if you know the actual tool you need
The following is the text extract from the “About this site” text file
What is this? This is a file share allowing access to all Sysinternals utilities. We have developed this to test an alternate distribution mechanism for our utilities. This will allow you to run these tools from any computer connected to the Internet without having to navigate to a webpage, download and extract the zip file. If you are unfamiliar with Microsoft Windows Sysinternals, it is highly recommended that you visit the website at http://technet.microsoft.com/sysinternals before using these tools. If you have any questions or comments on this file share, please email syssite@microsoft.com Regards, The Microsoft Windows Sysinternals Team
Thanks to the team for providing this method of getting access to their invaluable tools and Thanks to Twitter for alerting me to it.
The year started with me moving from a Sony Vaio to a MacBook Pro and getting some amazing help from my twitterati, specifically @dawoo, as finding basic functions – like the hash key – seemed to allude me. I am now totally loved up with my MBP, iPad and iPhone 4S, I can’t ever contemplate moving back to Windows, albeit as part of the benefits of being a vExpert, I do run VMware Fusion
. One thing I can categorically state, though, is that Microsoft Office is as shocking on the Mac as it is on Windows for crashing or closing for no reason ![]()
In February, I attended the IDC Desktop Virtualization event in London and it was clear the interest in desktop transformation in general was heightened, specifically regarding where to start, whether looking at desktop or application virtualization or just moving to Windows 7. This was preceded by the London VMUG having a roundtable discussion on VDI, which also indicated high levels of interest, but no real evidence of large, or successful, implementations. So 2010 was meant to be the year of VDI, so was 2011, but I do believe 2012 will be the year of the ‘blended’ workspace, where virtualization will play a part but will not be the panacea many thought, or were led to believe, it would be.
May saw BriForum return to the UK, with over 300 delegates attending, again demonstrating the keen appetite for knowledge on desktop virtualization and associated solutions. The day after BriForum, we held our new format for the London VMUG. The new registration format via MyVMUG organization, the extended day, multiple tracks and sponsorship were well received by our members and, as always, lots of positive tweets and blogs were posted.
A relatively new topic, the consumerization of IT, was the focus of another London IDC event in London, which I again attended with Centrix Software. The other sponsors (including Citrix and Samsung) all focused on the BYOD (bring your own device) aspect of consumerization. However, it is so much more than that; what about applications user-sourced from the cloud, off-prem storage such as dropbox – how does IT embrace consumerization, but retain control? It was a very thought provoking event for the many enterprise IT managers in attendance, clearly a topic for the forthcoming year too.
June also saw the UKs VMware Forums, I attended Wembley and bumped into many of the London VMUG members, it was an excellent event for both attendees and sponsors alike.
August was all about attending VMworld Las Vegas. The highlight for me was meeting many of the vExperts from the other side of the pond that I interact with over Twitter; such as Shane Williford, Aaron Delp and Damian Karlson to name but a few. I feel very honored to be part of this awesome community! Lots of great sessions, keynotes and labs were all other highlights, as well as the solutions exchange, where I spent most of mine time, working
. The VMworld party was great and it was nice to meet the better halves of Mike Laverick and Tom Howarth later at the pool party!!
To finish off my virtualized year, the highlight has to be the first ever UK National VMUG that I and my fellow London VMUG committee members, along with the MyVMUG organization, organized in Solihull on November 3rd. We had over 350 attendees, and over 20 sponsors, with multiple presentation tracks and community involvement with a mock-VCDX panel and PowerCLI workshops all taking place simultaneously. Hearing about individual’s experiences during the day and knowing that for many, this was their first ever VMUG, made all the hard work and voluntary effort all worthwhile
. A great review of the event was posted by one of our members and regular contributors to London VMUG, Jonathan Medd, read it here.
I am now looking forward to an exciting 2012 – desktop transformation is going to be even bigger next year, as is consumerization of IT but I’m also going to be involved in a Cloud Foundry initiative that will launch in the new year, so watch this space!
In the meantime, wishing everyone all the best for the festive season and a very Happy New Year and looking forward to seeing many of you in January at our 26th London VMUG!
Jane Rimmer is owner of hiviz-marketing , strategic marketing consultancy servicing the IT industry and a 2011 vExpert.
VMware have just release a new KB article, well to be fair it is not really a KB article persay but more of a KB grouping article.
Troubleshooting ESX virtual machine performance issues is actually just a holding page for a load of extremely useful troubleshooting advice links.
Bookmark this link because it will be useful.
This is the second of this weeks releases and again it is an update. once again this update is due to patches being made available for vSphere 5, if you are not running vSphere 5 and have previously updated your hosts with this patch no further action is required.
Things have been a little quiet in the land of VMware security advisories the last couple of weeks but there are two this week. this first one is an update of one originally released in June of this year and seems to cover the entire gamut of VMware hypervisor products, both hosted and bear metal. That said, this update only actually refers to vSphere 5.0, if you have applied the patches previously to those products mentioned there is no need for further action.
so as per our usual practice the advisory is shown below.
Well it only seems yesterday that we were all sat in the Motor-Cycle Museum at the first National UK VMUG. But here we are with the next London one just around the corner.
The location is the same as always, 33 Queen St at the London Chamber of Commerce and as usual they have a decent set of Vendors to display their wears and speakers both commercial and VMUG Member based.
If you have never been to the London VMUG I would highly recommend it, you can often meet such Virtualisation illuminati like Alan Renouf (www.virtu-al.net), Simon Seagrave (www.techhead.co.uk) and occasionally we get real royalty like Duncan Epping and Massimo Re Ferre
Full Details of the Meeting can be found here, where you can also Sign up and register. Seriously folks if you have never been to a VMUG attend, it is worth it. You get to listen to fellow folk who have shared your pains, or even already solved your issues. and finally do not forget the After party in the Pavilion End pub.
Recently, I’ve come across a number of people that are just starting to “get into” Twitter. Having been tweeting for nearly 3 years, I think I’ve grasped the main concept and have witnessed both good and bad use of this social media vehicle. So I thought I’d note down some general guidance for those “neweeters” out there that would like to start tweeting.
Twitter is described as a micro-blogging site, allowing you to update your status in 140 characters. However, I see many different uses of Twitter, it is a great way to keep in touch of industry trends/happenings, a great source of information – just ask a question on Twitter and I guarantee you’ll get an informed response within seconds if you have a large enough following – through to companies using it as a support forum.
This blog, however, is designed to give input and advice to the first time user community.
Getting started
1. Choose a name (handle) that either bears a resemblance to your real name or is indicative of your interests. My handle, @Rimmergram, is a combination of my name and my love of communicating. It has also been said, in the past, to receive a ‘Rimmergram’ was not something that was a pleasant read, as it meant you had done something pretty bad to receive one! In my ‘Twitterverse’ a Rimmergram is, hopefully, a pleasant read
If asked for your twitter handle, it is always preceded by the @ symbol, this is how people connect with you on Twitter and links to your Twitter profile.
2. Having chosen and created your handle, you then need to create your profile. Like Twitter, your profile is restricted to 140 characters. So be precise and succinct. Do not, however, go the other way and NOT include a profile. People will not necessarily follow you if they don’t know anything about you.
3. Next step is to include an avatar. People either use a picture of themselves, a cartoon representation of themselves or something completely off the wall! My preference is to use a photo that looks like you, this way, when you do get to meet your followers, they can at least recognize you
4. Once you’re set up, then you need to start following people in your sphere of interest. I find the best way is to look at the list of tweeps other people are following and start following them.
5. Accessing Twitter. You can either do this via twitter.com or use an application. I use Tweetdeck as I track different accounts and hashtags (in fact I have 14 columns!) on my laptop and iPad and on my iPhone I like the Echofon app.
Etiquette
For me, etiquette is common sense and, as with email, do not type something that you wouldn’t say to someone in person. There is also different etiquette, in my opinion, depending upon your twitterverse and area of interest. There seems to be certain etiquette in tweeting with celebrities, but personally, I don’t follow any! But there are certain things I’ve witnessed on Twitter that I personally don’t agree with this. Below I highlight just a few, there are various sites that highlight twettiquette, I quite like this one, but below are just a couple of suggestions from yours truly:
Do not use Twitter to get into a slanging match
Do not use Twitter for a conversation, use the DM function or email
Do not reply to a tweet that was sent days ago
Know with whom you are tweeting – they could be a customer of yours!
I strongly advise against sending Dweets, see glossary below!
Do use Twitter as an information medium, both sharing and receiving
Do turn Twitter off if you are concentrating on completing a task, it’s highly intrusive and addictive.
Useful glossary
Direct Message (aka DM) – you can DM people on Twitter only if they are following you.
Follower – someone that subscribes to your tweets. You don’t necessarily have to follow them back (unlike Facebook where all relationships have to be reciprocal, you can have a one-way relationship on Twitter)
Dweet – a tweet sent when drunk
Hashtags # – used to highlight a particular topic that can then be searched on and tracked to see if it is trending. A popular hashtag is #FF or #FollowFriday. This is used to highlight tweeps you feel are worthy of following
OH – stands for overheard, tweets that are not associated with an identifiable person
PRT – please retweet – although if a tweet is good enough it will be retweeted on it’s own merits, only in special cases should you request your tweet to be retweeted
Re-Twee (RT)t – essentially a ‘forward’ of your tweet to the retweeter’s followers
Tweeple, twerson, tweeps – all terms for people using Twitter
Tweetup – a face-to-face meeting of tweeps
Twitterati – the A-listers of Twitter
Twitterverse – the Twitter Universe, it’s big and growing at an exponential rate.
Twitosphere – the world of Twitter
Summary
Success on Twitter, for me, is defined by having one of my tweets retweeted (RT’d) by someone I hugely admire and respect on Twitter – it means they’re interested in something I’ve tweeted enough to forward to their followers.
For those diehard tweeters like me you can find out your “twuration” by visiting www.twuration.com. Here I learnt I’ve been tweeting since 4th December 2008 and, on average, I tweet 6.6 times a day – is this verging on addiction I ask myself?!
Finally, if you do tweet something you’d rather not have, you can delete a tweet, but remember, if you’ve include a hashtag or @someone, then they might well have seen it before you delete it and can then, in turn, retweet it!
Jane Rimmer is owner of hiviz-marketing , strategic marketing consultancy servicing the IT industry and a 2011 vExpert.
A new one for you today. this one relates to a vulnerability in VUM whereby there is a risk of directory traversal because of a issue in the Jetty web server. It only relates certain versions of VUM however and has been closed in the latest Updates of 4.1 and 4.0