VMware removes hard-coded root access key from vSphere Data Protection

VMware has released a patch for vSphere Data Protection (VDP) to modify a hardcode SSH key that could allow remote attackers to gain root access to the virtual device.

VDP is a backup product and restore disk that works as an open virtual device (OVA). It integrates with VMware vCenter Server and provides centralized management of backup tasks for up to 100 virtual machines.

According to the VMware support article, the vSphere Data Protection Device (VDP) contains a static SSH private key with a known password. This key enables interoperability with EMC Avamar deduplication solution backup and recovery software, and is preconfigured in the VDP as AuthorizedKey.

"An attacker with access to the internal network can take advantage of this to access the device with root privileges and more to complete a complete transaction," VMware said.

The Company believes that this is critical and the development of a solution that can be copied and executed on the device to change the default SSH key and set a new password.

Developing devices with access to encrypted information that users can not change is a serious security weakness. Unfortunately, it was a common practice in the past and vendors have tried cleaning up such errors from their devices for years.

Tuesday, VMware has also fixed a cross-site scripting vulnerability stored in its vSphere Hypervisor (ESXi) product. The fault is considered important.

"The problem can be introduced by an attacker who has permission to manage virtual machines through ESX host or client to trick the vSphere administrator to import a designed virtual machine," the company said in a statement. "The problem can be activated on the system from which ESXi client host is used to manage the designed virtual machine."

VMware has released security patches for ESXi 5.5 and 6.0 to address this issue and advises users not to import virtual machines from untrusted sources.

How Amadeus Leveraged The Cloud And VMware To Help The Travel Industry

Travelers want to spend less money when they make arrangements, and they rely more and more on apps and websites to keep costs low.

It's high-pressure work to keep these digital services running at optimum performance at a reasonable cost, said Wolfgang Krips, executive vice president, Global Operations and General Manager, Amadeus IT.

"And on top of that, you have to build your innovation, which means new business services," he said.

Amadeus, a multinational IT service provider, fire 3 billion a year to provide the global travel industry with what it needs. But more.

For two years, Amadeus has decided to modernize its infrastructure. Amadeus leaders have considered a variety of options, including cloud service providers and utilities.

He chose to build a private cloud business in partnership with Red Hat, VMware and other service companies and software needed for the private cloud he wanted.

Amadeus has been operated by VMware's integrated OpenStack, which manages cloud resources through interconnected components that control the processing, storage, and network equipment. NSX VMware has provided Amadeo with virtual networking and security software.

Watch this video to learn more about how VMware NSX network virtualization solutions had a positive impact on Amadeus.

Krips said the upgrade of its base aligns with the fundamental objectives of Amadeus customers.

"What I can implement virtualisation of container applications (simple), VM (virtual machines) or bare metal, or if I use OpenStack, everything is a means to an end," said Krips. "Ultimately, what the customer expects is capacity, agility, and ongoing cost reductions, and that's what we have to offer."

Dynamism and automation were - and still are - essential, according to Dietmar Fauser, Amadeus vice president of Research and Development.

"That's why we use this technology, and why we use quality industrial partners," said Fauser.

OpenStack is not at the same time public, has said that, although it believes that will be the case.

The choice of an OpenStack Amadeus approach made by VMware, which according to Fauser, has a solid understanding of virtualization.

VMware aims to simplify cross-cloud challenges

Customers face enormous challenges when moving to the cloud; According to Guido Appenzeller, Head of Technology Strategy, Network / Business Security Unit, at VMware, AWS, Azure, Google and IBM Public Clouds, as well as a data center in the field. The question is how to connect them all together?

Appenzeller stated that VMware's Cross-Cloud services, currently under development, are intended to provide consistent deployment models, security policies, visibility and governance for all applications, whether they are executed on-site or off and independent of the underlying cloud or hypervisor.

Appenzeller, VMware's Cloud Services Services leader, recently joined John Furrier (@furrier), co-host of theCUBE (* disclosure below) of the SiliconANGLE Media team. VMware is a leading provider of VMware, VMware, and VMware.

Why customers want multiple clouds

"I think what we are seeing is that customers use different clouds for their specificities, or the best properties of the breed," Appenzeller said. For example, AWS has by far the largest catalog; Google has cheap storage; And Microsoft is very aggressive about licensing its own products over Azure, "he explained. A client can choose one of them - or all - to get their individual benefits.

In the cloud, the network is the hardest problem, including the configuration of a firewall, said Appenzeller. This is where VMware has found an opportunity because its NSX network virtualization platform already allows a user to extend a network through heterogeneous hardware in the data center. It can take a Cisco or Arista switch and create a virtual network, so why can not it do the same in the cloud, Appenzeller asked?

Appenzeller explained that NSX really shines by not moving around workloads, but rather by giving IT teams powerful tools so they can handle these workloads across the clouds in the same way.

The future of managing inter-cloud architectures

Over the next five years, Appenzeller predicted that the majority of workloads will still be on-site, but will increase the shift to the cloud. When companies move in the cloud, they have to decide how to scale it in the future, "he explained. Thus, companies will begin to understand the complexity of managing the cloud or clouds.

"This entire transition from VMware to the provision of SaaS services for the public cloud; this, for me, is the future, and I am very excited about it," said Appenzeller.

Watch the full video interview with VMware 2016 by SiliconANGLE and the CUBE. (* Disclosure: VMware Inc. and other companies are sponsoring certain segments of VMware 2016 on theCUBE of SiliconANGLE Media