SymmetricalDataSecurity: April 2014

Wednesday, April 30, 2014

EMC Fellow @SteveTodd defines 5 criteria for achieving a “well-run" hybrid cloud http://bit.ly/1mglkPM #BAHCL http://bit.ly/1n5tWFM

via EMC Feeds http://bit.ly/1mgll6a

EMC Fellow @SteveTodd defines 5 criteria for achieving a “well-run" hybrid cloud http://bit.ly/1mglkPM #BAHCL http://bit.ly/1n5tWFM

via EMC Feeds http://bit.ly/1mgll6a

Multicard leaks data online in privacy breach: OAIC

The Office of the Australian Information Commission has found that Multicard failed to take reasonable steps to ensure that 9,000 applicant details would not be publicly exposed online.

via Latest Topic for ZDNet in Security http://zd.net/1fvc8UO

NSX Vision: Validated!

VMware has been on a journey to bring the same benefits of server virtualization to the network for over a decade, starting with virtual switches, accelerating to our vCloud Networking and Security suite, and culminating with our 2012 Nicira acquisition and launch of our VMware NSX™ network virtualization platform. In the new Gartner Magic Quadrant […]]> http://bit.ly/R2m1Oo 2 VMware Weekly News Recap, April 25 http://bit.ly/PSENXt http://bit.ly/R2m3WM Fri, 25 Apr 2014 15:00:53 +0000

No new criminal laws to combat cyberbullying: Fletcher

The federal government will not push for new criminal offences aimed at punishing cyberbullies, but will rely on existing criminal laws in its bid to stem cyberbullying, according to Liberal MP Paul Fletcher.

via Latest Topic for ZDNet in Security http://zd.net/R5uSi1

Leveraging @VMware, #EMC IT is innovating and reducing costs all in a transparent business model. Here's how. http://bit.ly/1mfTQK4

via EMC Feeds http://bit.ly/1mfTQKb

Leveraging @VMware, #EMC IT is innovating and reducing costs all in a transparent business model. Here's how. http://bit.ly/1mfTQK4

via EMC Feeds http://bit.ly/1mfTQKb

Learn how easy it is to create a virtual storage array with EMC ViPR http://bit.ly/R59WYz http://bit.ly/1hUK0ck

via EMC Feeds http://bit.ly/1hUJYkQ

Learn how easy it is to create a virtual storage array with EMC ViPR http://bit.ly/R59WYz http://bit.ly/1hUK0ck

via EMC Feeds http://bit.ly/1hUJYkQ

IBM Security Bulletin:Tivoli Netcool/OMNIbus_GUI Vulnerabilities - CVE-2014-0942; CVE-2014-0941

Service Vulnerabilities exist in the AEL and Event Viewer CVE(s): CVE-2014-0942 and CVE-2014-0941 Affected product(s) and affected version(s): Tivoli Netcool/OMNIbus_GUI 7.4 Refer to the following reference URLs for...

via IBM Product Security Incident Response Team http://bit.ly/R4VrUO

IBM Security Bulletin: Potential Security Vulnerabilities fixed in IBM WebSphere Application Server 8.5.5.2

Cross reference list for security vulnerabilites fixed in IBM WebSphere Application Server 8.5.5.2 CVE(s): CVE-2013-4039 , CVE-2013-6725 , CVE-2013-6325 , CVE-2013-6323 , CVE-2013-6329 , CVE-2013-6349 , CVE-2014-0823 , CVE-2013-6738 , CVE-2014-0857 ,...

via IBM Product Security Incident Response Team http://bit.ly/1nK2gIZ

EMC Isilon's Ryan Peterson catches up with Doug Cutting, the founder of Hadoop,...

EMC Isilon's Ryan Peterson catches up with Doug Cutting, the founder of Hadoop, to discuss the origins and future of Hadoop Distributed File Systems: http://bit.ly/1iIjfbP

via EMC Feeds http://bit.ly/1iBvxDT

EMC Isilon's Ryan Peterson catches up with Doug Cutting, the founder of Hadoop,...

EMC Isilon's Ryan Peterson catches up with Doug Cutting, the founder of Hadoop, to discuss the origins and future of Hadoop Distributed File Systems: http://bit.ly/1iIjfbP

via EMC Feeds http://bit.ly/1iBvxDT

USN-2189-1: Thunderbird vulnerabilities

Ubuntu Security Notice USN-2189-1

30th April, 2014

thunderbird vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 14.04 LTS

Ubuntu 13.10

Ubuntu 12.10

Ubuntu 12.04 LTS

Summary

Several security issues were fixed in Thunderbird.

Software description

thunderbird - Mozilla Open Source mail and newsgroup client

Details

Bobby Holley, Carsten Book, Christoph Diehl, Gary Kwong, Jan de Mooij,

Jesse Ruderman, Nathan Froyd and Christian Holler discovered multiple

memory safety issues in Thunderbird. If a user were tricked in to opening

a specially crafted message with scripting enabled, an attacker could

potentially exploit these to cause a denial of service via application

crash, or execute arbitrary code with the privileges of the user invoking

Thunderbird. (CVE-2014-1518)

Abhishek Arya discovered an out of bounds read when decoding JPG images.

An attacker could potentially exploit this to cause a denial of service

via application crash. (CVE-2014-1523)

Abhishek Arya discovered a buffer overflow when a script uses a non-XBL

object as an XBL object. If a user had enabled scripting, an attacker

could potentially exploit this to execute arbitrary code with the

privileges of the user invoking Thunderbird. (CVE-2014-1524)

Mariusz Mlynski discovered that sites with notification permissions can

run script in a privileged context in some circumstances. If a user had

enabled scripting, an attacker could exploit this to execute arbitrary

code with the privileges of the user invoking Thunderbird. (CVE-2014-1529)

It was discovered that browser history navigations could be used to load

a site with the addressbar displaying the wrong address. If a user had

enabled scripting, an attacker could potentially exploit this to conduct

cross-site scripting or phishing attacks. (CVE-2014-1530)

A use-after-free was discovered when resizing images in some

circumstances. If a user had enabled scripting, an attacker could

potentially exploit this to cause a denial of service via application

crash or execute arbitrary code with the privileges of the user invoking

Thunderbird. (CVE-2014-1531)

Tyson Smith and Jesse Schwartzentruber discovered a use-after-free during

host resolution in some circumstances. An attacker could potentially

exploit this to cause a denial of service via application crash or execute

arbitrary code with the privileges of the user invoking Thunderbird.

(CVE-2014-1532)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:: thunderbird 1:24.5.0+build1-0ubuntu0.14.04.1
Ubuntu 13.10:: thunderbird 1:24.5.0+build1-0ubuntu0.13.10.1
Ubuntu 12.10:: thunderbird 1:24.5.0+build1-0ubuntu0.12.10.1
Ubuntu 12.04 LTS:: thunderbird 1:24.5.0+build1-0ubuntu0.12.04.1

To update your system, please follow these instructions: http://bit.ly/1aJDvTw.

After a standard system update you need to restart Thunderbird to make

all the necessary changes.

References

CVE-2014-1518, CVE-2014-1523, CVE-2014-1524, CVE-2014-1529, CVE-2014-1530, CVE-2014-1531, CVE-2014-1532, LP: 1313886

via Ubuntu Security Notices http://bit.ly/1kqlEWo

IBM Security Bulletin: Apache Tomcat and FileUpload Vulnerabilities in IBM UrbanCode Deploy (CVE-2014-0050, CVE-2013-4286, CVE-2014-0033, CVE-2013-4322, CVE-2013-4590)

Previous releases of IBM UrbanCode Deploy are affected by vulnerabilities in Apache Tomcat and FileUpload that may allow remote attackers to influence the availability of the server or obtain sensitive information. CVE(s): CVE-2014-0050 , CVE-2013-4286...

via IBM Product Security Incident Response Team http://bit.ly/1hYjCKt

IBM Security Bulletin: IBM QRadar Security Information and Event Manager can be affected by a vulnerability in the IBM Runtime Environment, JavaTM Technology Edition, Version 6 and 7 (CVE-2014-0411)

Previous releases of IBM QRadar Security Information and Event Manager are affected by a transport layer security (TLS) timing vulnerability reported in the IBM Runtime Environment, JavaTM Technology Edition, Version 6 and 7. CVE(s): CVE-2014-0411 ...

via IBM Product Security Incident Response Team http://bit.ly/1hYjDhv

We'll be building a hybrid cloud live at #EMCWorld! Don't believe us? See for yourself here http://bit.ly/1hXRFT1

via EMC Feeds http://bit.ly/SbE3Pg

We'll be building a hybrid cloud live at #EMCWorld! Don't believe us? See for yourself here http://bit.ly/1hXRFT1

via EMC Feeds http://bit.ly/SbE3Pg

We'll be building a hybrid cloud live at EMCW. Don't believe us? See for yourself here http://bit.ly/1hTRDjj

via EMC Feeds http://bit.ly/1hTRCvV

We'll be building a hybrid cloud live at EMCW. Don't believe us? See for yourself here http://bit.ly/1hTRDjj

via EMC Feeds http://bit.ly/1hTRCvV

Can Your Disaster Recovery Plan Bounce Back?

Over the past few years it seems that we have experienced no shortage of natural disasters, especially during this week of horrible tornadoes affecting Mississippi, Alabama and Louisiana residents. In today’s world, having a disaster recovery solution in place can mean the difference between a business with a bright future, and one that closes up […]]>

Though today, it isn’t uncommon to find many small-to-medium-sized businesses that simply don’t implement Disaster Recovery at all because they believe it is either too complicated, too expensive or both. This may have been the case, but that was before VMware introduced the general availability of VMware vCloud® Hybrid Service™ – Disaster Recovery.

This DRaaS solution introduces native cloud-based disaster recovery capabilities for VMware vSphere virtual environments. It is simple to set up, and it provides a high level of self-service capabilities while requiring minimal configuration and user training, and is a fraction of the cost of traditional disaster recovery solutions. Built on VMware’s hypervisor-based replication engine, vSphere Replication, and new integration support with vCloud Hybrid Service, Disaster Recovery features include:

· Self-service disaster recovery protection for virtual machines

· Recovery point objectives (RPO) from 15 minutes to 24 hours

· Recovery time objectives (RTO) of four hours or less

· Automated failover testing, planned migrations and recovery

· Elastic cloud compute and storage capacity

· Support for offline data seeding

· Private leased line network option

· Flexible failover testing

This new disaster recovery service is ideal for customers who do not want to have to build and maintain tertiary disaster recovery sites. It’s also useful for organizations that want to protect more applications from data loss and downtime during a disaster, but cannot justify the cost and complexity of traditional Disaster Recovery.

Take a moment to learn more about VMware vCloud® Hybrid Service™ – Disaster Recovery by watching the video below.

Differentiate your business with Hybrid Cloud service capabilities, disaster recovery and business continuity services.Learn more and get started today. As always, be sure to follow us around the web and leave your comments on Partner Link.

- The VMware Partner Network Team

via VMware Blogs http://bit.ly/1hTuRIp

Can Your Disaster Recovery Plan Bounce Back?

· Self-service disaster recovery protection for virtual machines

· Recovery point objectives (RPO) from 15 minutes to 24 hours

· Recovery time objectives (RTO) of four hours or less

· Automated failover testing, planned migrations and recovery

· Elastic cloud compute and storage capacity

· Support for offline data seeding

· Private leased line network option

· Flexible failover testing

Take a moment to learn more about VMware vCloud® Hybrid Service™ – Disaster Recovery by watching the video below.

- The VMware Partner Network Team

via VMware Blogs http://bit.ly/1hTuRIp

USN-2184-2: Unity vulnerabilities

Ubuntu Security Notice USN-2184-2

30th April, 2014

unity vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 14.04 LTS

Summary

The Unity lock screen could be bypassed.

Software description

unity - Interface designed for efficiency of space and interaction.

Details

USN-2184-1 fixed lock screen vulnerabilities in Unity. Further testing has

uncovered more issues which have been fixed in this update. This update

also fixes a regression with the shutdown dialogue.

We apologize for the inconvenience.

Original advisory details:

Frédéric Bardy discovered that Unity incorrectly filtered keyboard

shortcuts when the screen was locked. A local attacker could possibly use

this issue to run commands, and unlock the current session.

Giovanni Mellini discovered that Unity could display the Dash in certain

conditions when the screen was locked. A local attacker could possibly use

this issue to run commands, and unlock the current session.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:: unity 7.2.0+14.04.20140423-0ubuntu1.2

To update your system, please follow these instructions: http://bit.ly/1aJDvTw.

After a standard system update you need to restart your session to make all

the necessary changes.

References

LP: 1314247

via Ubuntu Security Notices http://bit.ly/1rPB5fx

Vulnerabilidade de Dia-Zero do Internet Explorer está a Solta

A Symantec está ciente dos relatórios de vulnerabilidade de Dia Zero, Vulnerabilidade de Execução de Código Remoto para Microsoft Internet Explorer (CVE-2014-1776), que afeta todas as versões do Internet Explorer.

A Microsoft publicou um aviso de segurança sobre a vulnerabilidade no Internet Explorer, que está sendo utilizada em limitados ataques dirigidos. Atualmente não existe nenhum patch disponível para esta vulnerabilidade e a Microsoft, até o momento em que este texto foi escrito, não ofereceu uma data de divulgação desta correção.

Nossos testes confirmaram que a vulnerabilidade afeta o Internet Explorer do Windows XP. Esta é a primeira vulnerabilidade de Dia-Zero que não será corrigida para os usuários do Windows XP, pois a Microsoft encerrou o suporte deste sistema operacional em 8 de abril de 2014. No entanto, a Microsoft afirmou que o seu avançado kit de ferramentas de Mitigação (EMET) 4.1 e acima poderá mitigar essa vulnerabilidade do Internet Explorer que é suportado pelo Windows XP. Além de usar o EMET, a Symantec incentiva os usuários a mudarem temporariamente para um navegador da Web diferente até que uma correção seja disponibilizada pelo fornecedor.

Symantec protege os clientes contra este ataque, com as seguintes detecções:

Bloodhound.Exploit.552

Web Attack: MSIE Use After Free CVE-2014-1776

Nós vamos atualizar este blog com mais informações assim que estiverem disponíveis.

Atualização – 28 de Abril

Com a finalidade de reduzir a Vulnerabilidade de Execução de Código Remoto para Microsoft Internet Explorer (CVE-2014-1776) , a Symantec ofrece as seguintes recomendações

A Microsoft declarou que versões do avançado kit de ferramentas de Mitigação (EMET) 4.1 e superiores podem atenuar essa vulnerabilidade no Internet Explorer. O kit de ferramentas está disponível para usuários do Windows XP também. Se a utilização do EMET não for uma opção, os usuários podem considerar como forma de reduzir o problema anulando o registro de um arquivo DLL chamado VGX.DLL. Este arquivo provê suporte para VML (Vector Markup Language) no navegador. Essa ação não é necessária para a maioria dos usuários. No entanto, ao anular o registro da Library qualquer aplicação que utilize DLL não funcionará de maneira apropriada. Igualmente, algumas aplicações potencialmente instaladas no sistema podem se registrar no DLL. Com isso em mente, a seguinte linha de instruções pode ser executada para tornar imune o sistema de ataques que tentem explorar esta vulnerabilidade. Esta linha de recomendações pode ser usada para todos os sistemas operativos afetados.

"%SystemRoot%\System32\regsvr32.exe" -u "%CommonProgramFiles%\Microsoft Shared\VGX\vgx.dll"

Nós também desenvolvemos um arquivo de lote que pode ser utilizado para executar a tarefa para aqueles que necessitem administrar grandes infra-estruturas de TI.

Nota: Os usuários terão de renomear o arquivo usando uma extensão .bat

O arquivo de lote tem a capacidade de verificar o estado atual do arquivo DLL e cancelar o registro da DLL, conforme necessário. O roteiro descrito no arquivo de lote é muito simples e pode ser usado como uma base para customizar o código para atender às necessidades de certos ambientes de sistema.

Apesar de nenhuma ferramenta especial ser necessária para atenuar essa vulnerabilidade, por favor note que as recomendações, como as fornecidas aqui, podem não ser as mesmas possíveis para vulnerabilidades futuras. Recomendamos que os sistemas operacionais não suportados, como o Windows XP, sejam substituídos por versões atualizadas, logo que possível.

via Symantec Connect - Security - Blog Entries http://bit.ly/1o446BQ

The exploding #DigitalUniverse means big opportunity for CIOs and IT. #EMC CIO @VicBhagat offers his take. http://bit.ly/1o41Ydv

via EMC Feeds http://bit.ly/1fyUJdz

The exploding #DigitalUniverse means big opportunity for CIOs and IT. #EMC CIO @VicBhagat offers his take. http://bit.ly/1o41Ydv

via EMC Feeds http://bit.ly/1fyUJdz

Bringing VMware and AirWatch together

AirWatch is our biggest acquisition ever and as you can imagine, customers and partners alike are eager to hear how we plan to integrate it into VMware. Specifically, how are we going to bring the two traditionally separate silos of desktop and mobile together? To help explain our vision for uniting VMware and AirWatch, we released a video describing our architecture and technology integration plans. Definitely watch the video to learn more, and the rest of this blog will give you a summary of our plans and a bit more color on certain areas. Vision First, I want to make it clear that this is not about just integrating two sets of technologies. It’s about setting a vision for end-user computing and helping to drive the industry forward. That vision is quite simple: users should be able to access all of their data and apps on any device without compromise, and IT should be able to seamlessly and consistently manage and secure all these apps, data, and devices. Unfortunately, in today’s environment, users have to compromise a lot as they switch between devices, in terms of capabilities and application support. Similarly, desktop and mobility management have little in common, usually driven [...]]> AirWatch is our biggest acquisition ever and as you can imagine, customers and partners alike are eager to hear how we plan to integrate it into VMware. Specifically, how are we going to bring the two traditionally separate silos of desktop and mobile together?

To help explain our vision for uniting VMware and AirWatch, we released a video describing our architecture and technology integration plans. Definitely watch the video to learn more, and the rest of this blog will give you a summary of our plans and a bit more color on certain areas.

Vision

First, I want to make it clear that this is not about just integrating two sets of technologies. It’s about setting a vision for end-user computing and helping to drive the industry forward. That vision is quite simple: users should be able to access all of their data and apps on any device without compromise, and IT should be able to seamlessly and consistently manage and secure all these apps, data, and devices. Unfortunately, in today’s environment, users have to compromise a lot as they switch between devices, in terms of capabilities and application support. Similarly, desktop and mobility management have little in common, usually driven by separate IT teams with different areas of expertise. Yes, there are many companies out there, point players that help bridge the gap in this way or that, but the reality is that this has been a fragmented marketplace. The opportunity for us (VMware + AirWatch) and the industry is to provide a unified solution built on best-of-breed components.

As with any vision, this one will be a journey. The integration of VMware and AirWatch will occur in phases, with some easy wins first and the disruptive innovations following. What I want to present here is the complete vision and how we plan to achieve it. This plan will include not only identifying integration points, but also extending existing technologies to meet the needs of the integration. I won’t go into timelines here, but rest assured we’re already hard at work and you should expect to see updates at VMworld and through the rest of 2014. Ok, on to the integration!

Architecture

In identifying the different integration points between VMware and AirWatch, it’s useful to have a big picture view of what it is we’ll be integrating. This is the diagram we’ve been using to help visualize the integration:

As you can see, we’ve organized the diagram into rows. The lowest row is the physical devices end-users own (BYOD) or use (corporate-owned or COPE – corporate-owned, personally enabled). These span various types of PCs to all sorts of mobile devices. Above that is all the various services and applications end-users access or consume, such as full virtual desktops, published applications (both through XenApp and now with Horizon 6, ThinApp, SaaS/web apps, and of course, mobile apps). The next row is Workspace Services, which consists of common services that span applications and devices, such as a portal or app catalog, identity and authentication, files/data (EFSS – enterprise file sync and share and MCM – mobile content management), and social. Finally there is the management layer, where the desktop and mobile worlds are managed and configured.

While there is a separation between desktop and mobile today, there are many common sets of functionalities between the two. Indeed, many of the integration points should be obvious visually from just looking at the above diagram. So how will we bridge the divide? The key here is to focus on use cases.

End-Users

Let’s start with end-users. End-users want a no-compromise and consistent experience on the device of their choice. Thus they should have one place to go regardless of device to get access to their apps and data – i.e. one user portal. VMware Workspace provides a strong basis for this today, as it supports all desktop and SaaS apps. We could easily integrate in mobile apps:

Of course, it’s not just tying the app catalogs together, it’s about enabling a single identity and single sign-on across desktop and mobile. Users also expect their files to be synced seamlessly across all their devices and want one place to go to access all their files. AirWatch Secure Content Locker (SCL) is already that central access point, as it enables device connectivity to corporate datastores on Sharepoint and CIFS in addition to cloud services like OneDrive and Google Drive. So we have the opportunity to create a common data solution by integrating Horizon Data capabilities deeply into SCL for a seamless user experience.

Finally, social is changing from just being a place you go into a property of things. Today Socialcast is a website (with a corresponding mobile app) where users go to collaborate. But social should also be embedded in everything users access: their app portal, their files/data, their devices. For instance, an example integration is Socialcast and SCL. Today in Socialcast, users can attach files to conversations. With SCL, users can include comments on files. But the two aren’t connected. By connecting Socialcast and SCL, we could cross-reference the social network and the file/data network. This would allow users and the enterprise to have a much better understanding about relationships between people and data, leading to useful insights. Very powerful stuff!

How does this benefit end-users? First, users can have the same set of applications available to them irrespective of device. The portal and app catalog can be available both on desktop and on mobile, and users could be able to easily launch the apps of their choice. And the app launch could be context sensitive. For instance, if the user wants to run Workday and is on a desktop, then the Workday SaaS app would pop up in a browser, already logged in and ready to go. If the user is on an iOS device, the app launcher will know that and run the Workday iOS app. Again, a seamless experience for the user.

Second, users can switch easily between devices. Think of it like Netflix: you start watching a movie on your TV at home, pause it halfway through, and then at some point later you pick up your tablet and you can start right where you left off. Our unified solution could offer the same experience, but for a user’s apps, data, and content. A user can start working on a tablet, realize a physical keyboard might be easier for the task, and switch to a laptop and start right where she left off. This is extremely powerful and would be a boon for end-users.

Third, we have the opportunity to thread social through all of this. Users can know who’s been accessing files they’ve shared or who’s been collaborating on a given file. This would make it much easier to know who to work with on a given issue, as the information is all there and readily available.

In the end, we’re trying to create a seamless experience for end-users: they can use the device of their choice without compromise, switch between devices without missing a beat, and enhance the way they collaborate. We think this is a huge win for end-users!

Admins

What about admins? In the end they want a simple way to secure and manage devices. Every customer we’ve talked to that’s used AirWatch loves the simplicity of the admin UI and of the mobility management paradigm in general.

With mobility, admins deal with three things: users, policies (which are sometimes device-specific), and apps/content. There’s no complex scripting needed; instead it’s just a simple admin UI where they can check the boxes for options they want and map users to policies to apps/content. It’s that simple.

Contrast that with desktop, where the tools today are still somewhat archaic. This is primarily due to the Windows OS, where applications are not locked down at all by default (say, compared to iOS) and where applications can interfere with each other (e.g. through clashing DLLs, registry settings, etc). This forces a full image management model, where instead of talking about apps and content, we talk about images instead (which mash together apps, content, and even policy) – really a bit of a hairball. The result is something that’s much harder to manage than mobile. So the goal should be to simplify desktop management and align it with the mobility management paradigm. In order to do that, there are two primary enabling technologies: layering and user-environment management.

Layering is a technique for digging into Windows and splitting up a Windows image into “layers” that comprise logical sets of functionality, such as an application, the base Windows OS, and user data, that are isolated and can easily be inserted and removed – a giant step toward untangling the hairball! User environment management (UEM) refers to management of the Windows user persona and security and capabilities of the Windows OS. This both enhances security and improves Windows manageability by enabling finer-grained policy controls, similar to what mobile OSes have.

How does all this fit together? Let’s take an example we’re hearing about frequently from customers today: employees wanting to bring in their own laptops (PC or Mac) and get the full suite of IT services on those laptops. IT wants a secure, controlled environment, but the user doesn’t want IT to take complete control of their personal device. Sounds a lot like the problems with mobile devices, right? The solution for desktop is to leverage a local type 2 hypervisor provided by VMware Player Plus or VMware Fusion Professional to run a locked down, secure desktop VM provided and maintained by IT. The opportunity is to seamlessly manage that VM using layering provided by VMware Mirage and administer it in AirWatch, just like any mobile device. This solution strongly resonates with customers, as they see the possibility of dramatically simplifying BYO desktop management.

This is just one example, but the potential for applying the mobility management paradigm to desktop is huge. This would greatly simplify administration of all devices, since now a device is just a device and IT can focus on users, policies, and apps/content. A win-win for everybody!

Bringing It Together

Based on the above, we can take another look at our architecture diagram with the proposed integrations in place:

As you can see, we can integrate all the different pieces from Workspace Services to create a truly seamless and immersive experience for end-users regardless of the device they choose to use. For admins, layering and UEM can enhance the manageability of desktops, allowing them to manage desktops in the same simple way they manage mobile devices today, enabling a unified management paradigm. We think these integrations would be a huge win for admins and end-users alike.

Of course this is not an exhaustive list of every integration we’re thinking about, but hopefully this gives you a big picture view of how these two best-of-breed pieces could come together to create a unified solution. As I said at the beginning, integrations are a journey, both for us and our customers. But results will start emerging quickly – expect to hear a lot more at VMworld. We’re really excited about the opportunity here and hope you are too. What are your thoughts on these technology integration plans? Will your organization be able to benefit from our mobile unified solution? Please share your feedback below.

via VMware Blogs http://bit.ly/1iJdB9m

Infosecurity Europe 2014 > Whistleblowing Keeps Security Under Scrutiny Says Hypponen

Whistleblowers have exposed issues around data custody and data privacy, says Mikko Hypponen.

via Infosecurity - Latest News http://bit.ly/1o3FLw1

EMC Isilon's @BigDataRyan catches up with @Cutting, the founder of @Hadoop, to discuss the origins and future of HDFS http://bit.ly/1rFIxbf

via EMC Feeds http://bit.ly/1rFIvQx

EMC Isilon's @BigDataRyan catches up with @Cutting, the founder of @Hadoop, to discuss the origins and future of HDFS http://bit.ly/1rFIxbf

via EMC Feeds http://bit.ly/1rFIvQx

USN-2188-1: elfutils vulnerability

Ubuntu Security Notice USN-2188-1

30th April, 2014

elfutils vulnerability

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 14.04 LTS

Ubuntu 13.10

Ubuntu 12.10

Summary

elfutils could be made to crash or run programs if it processed a specially crafted file.

Software description

elfutils - collection of utilities to handle ELF objects

Details

Florian Weimer discovered that the elfutils libdw library incorrectly

handled malformed compressed debug sections in ELF files. If a user or

automated system were tricked into processing a specially crafted ELF file,

applications linked against libdw could be made to crash, or possibly

execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:: libdw1 0.158-0ubuntu5.1
Ubuntu 13.10:: libdw1 0.157-1ubuntu1.1
Ubuntu 12.10:: libdw1 0.153-1ubuntu1.1

To update your system, please follow these instructions: http://bit.ly/1aJDvTw.

In general, a standard system update will make all the necessary changes.

References

CVE-2014-0172

via Ubuntu Security Notices http://bit.ly/1rOKpjV

USN-2187-1: OpenJDK 7 vulnerabilities

Ubuntu Security Notice USN-2187-1

30th April, 2014

openjdk-7 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

Ubuntu 14.04 LTS

Ubuntu 13.10

Ubuntu 12.10

Summary

Several security issues were fixed in OpenJDK 7.

Software description

openjdk-7 - Open Source Java implementation

Details

Several vulnerabilities were discovered in the OpenJDK JRE related to

information disclosure, data integrity and availability. An attacker could

exploit these to cause a denial of service or expose sensitive data over

the network. (CVE-2014-0429, CVE-2014-0446, CVE-2014-0451, CVE-2014-0452,

CVE-2014-0454, CVE-2014-0455, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458,

CVE-2014-0461, CVE-2014-2397, CVE-2014-2402, CVE-2014-2412, CVE-2014-2414,

CVE-2014-2421, CVE-2014-2423, CVE-2014-2427)

Two vulnerabilities were discovered in the OpenJDK JRE related to

information disclosure and data integrity. An attacker could exploit these

to expose sensitive data over the network. (CVE-2014-0453, CVE-2014-0460)

A vulnerability was discovered in the OpenJDK JRE related to availability.

An attacker could exploit this to cause a denial of service.

(CVE-2014-0459)

Jakub Wilk discovered that the OpenJDK JRE incorrectly handled temporary

files. A local attacker could possibly use this issue to overwrite

arbitrary files. In the default installation of Ubuntu, this should be

prevented by the Yama link restrictions. (CVE-2014-1876)

Two vulnerabilities were discovered in the OpenJDK JRE related to data

integrity. (CVE-2014-2398, CVE-2014-2413)

A vulnerability was discovered in the OpenJDK JRE related to information

disclosure. An attacker could exploit this to expose sensitive data over

the network. (CVE-2014-2403)

Update instructions

The problem can be corrected by updating your system to the following package version:

Ubuntu 14.04 LTS:: openjdk-7-jre-lib 7u55-2.4.7-1ubuntu1; openjdk-7-jre-zero 7u55-2.4.7-1ubuntu1; icedtea-7-jre-jamvm 7u55-2.4.7-1ubuntu1; openjdk-7-jre-headless 7u55-2.4.7-1ubuntu1; openjdk-7-jre 7u55-2.4.7-1ubuntu1
Ubuntu 13.10:: openjdk-7-jre-lib 7u55-2.4.7-1ubuntu1~0.13.10.1; openjdk-7-jre-zero 7u55-2.4.7-1ubuntu1~0.13.10.1; icedtea-7-jre-jamvm 7u55-2.4.7-1ubuntu1~0.13.10.1; openjdk-7-jre-headless 7u55-2.4.7-1ubuntu1~0.13.10.1; openjdk-7-jre 7u55-2.4.7-1ubuntu1~0.13.10.1
Ubuntu 12.10:: openjdk-7-jre-zero 7u55-2.4.7-1ubuntu1~0.12.10.1; icedtea-7-jre-jamvm 7u55-2.4.7-1ubuntu1~0.12.10.1; icedtea-7-jre-cacao 7u55-2.4.7-1ubuntu1~0.12.10.1; openjdk-7-jre-lib 7u55-2.4.7-1ubuntu1~0.12.10.1; openjdk-7-jre-headless 7u55-2.4.7-1ubuntu1~0.12.10.1; openjdk-7-jre 7u55-2.4.7-1ubuntu1~0.12.10.1

To update your system, please follow these instructions: http://bit.ly/1aJDvTw.

This update uses a new upstream release, which includes additional bug

fixes. After a standard system update you need to restart any Java

applications or applets to make all the necessary changes.

References

CVE-2014-0429, CVE-2014-0446, CVE-2014-0451, CVE-2014-0452, CVE-2014-0453, CVE-2014-0454, CVE-2014-0455, CVE-2014-0456, CVE-2014-0457, CVE-2014-0458, CVE-2014-0459, CVE-2014-0460, CVE-2014-0461, CVE-2014-1876, CVE-2014-2397, CVE-2014-2398, CVE-2014-2402, CVE-2014-2403, CVE-2014-2412, CVE-2014-2413, CVE-2014-2414, CVE-2014-2421, CVE-2014-2423, CVE-2014-2427, LP: 1283828

via Ubuntu Security Notices http://bit.ly/QZURrr

Project Liberty: EMC's newest emerging technology to be announced next week at #EMCWorld http://bit.ly/1hSnh0C http://bit.ly/1n2g6E0

via EMC Feeds http://bit.ly/1n2g92V

Project Liberty: EMC's newest emerging technology to be announced next week at #EMCWorld http://bit.ly/1hSnh0C http://bit.ly/1n2g6E0

via EMC Feeds http://bit.ly/1n2g92V

	Introducing the VNXe The new VNXe3200 is simple, efficient, and affordable. Learn more: http://emc.im/1izn1iQ.	From: EMC Views: 2 0 ratings
	Time: 01:15	More in Science & Technology

via EMC Feeds http://bit.ly/QZEuva