{"id":820,"date":"2023-02-06T10:46:18","date_gmt":"2023-02-06T10:46:18","guid":{"rendered":"https:\/\/www.cert.hr\/novosti\/upozorenje-iskoristavanje-ranjivosti-vmware-esxi-hipervizora-za-ransomware-napade\/"},"modified":"2026-11-04T08:49:22","modified_gmt":"2026-11-04T08:49:22","slug":"upozorenje-iskoristavanje-ranjivosti-vmware-esxi-hipervizora-za-ransomware-napade","status":"publish","type":"post","link":"https:\/\/cert.hr\/en\/ranjivosti\/upozorenje-iskoristavanje-ranjivosti-vmware-esxi-hipervizora-za-ransomware-napade\/","title":{"rendered":"[UPOZORENJE] Iskori\u0161tavanje ranjivosti VMware ESXi hipervizora za ransomware napade"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Nacionalni CERT je zaprimio informacije o<strong> ranjivosti VMware ESXi hipervizora<\/strong> koja se iskori\u0161tava za izvo\u0111enje <strong>ESXiArgs i Nevada ransomware<\/strong> napada.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ranjivosti se iskori\u0161tavaju za izvr\u0161avanje proizvoljnog programskog koda u sustavima (engl. remote code execution \u2013 RCE). Naj\u010de\u0161\u0107e se radi o <a href=\"https:\/\/cve.cert.hr\/?q=CVE-2021-21974\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-21974 ranjivosti<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">OpenSLP (port 427), koji je naj\u010de\u0161\u0107e razlog kompromitacije, kori\u0161ten u ESXi hipervizoru sadr\u017ei ranjivost za izvo\u0111enje <em><strong>heap-overflow<\/strong><\/em> napada (ina\u010dice 7.0 prije ESXi70U1c-17325551, 6.7 prije ESXi670-202102401-SG, 6.5 prije ESXi650-202102101-SG) putem kojeg napada\u010d dobiva mogu\u0107nost izvr\u0161avanja proizvoljnog programskog k\u00f4da.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Upozoravamo da je zahva\u0107ene verzije <strong>potrebno \u0161to prije sigurnosno zakrpati<\/strong> kako ne bi do\u0161lo do ransomware napada. Nacionalni CERT uvijek nagla\u0161ava da je najbolja za\u0161tita od ransomware napada redovita <strong><a href=\"https:\/\/cert.hr\/en\/svjetski-dan-sigurnosnih-kopija-ili-world-back-up-day\/\" target=\"_blank\" rel=\"noreferrer noopener\">izrada sigurnosnih kopija podataka<\/a><\/strong> koje je potrebno dr\u017eati izdvojeno od samih sustava.\u00a0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Vi\u0161e informacija o ranjivosti i potrebnim koracima za\u0161tite na:<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/www.bleepingcomputer.com\/news\/security\/massive-esxiargs-ransomware-attack-targets-vmware-esxi-servers-worldwide\/<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-21974\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-21974<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/cve.cert.hr\/cve\/CVE-2021-21974\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/cve.cert.hr\/cve\/CVE-2021-21974<\/a><\/p>","protected":false},"excerpt":{"rendered":"<p>Nacionalni CERT je zaprimio informacije o ranjivosti VMware ESXi hipervizora koja se iskori\u0161tava za izvo\u0111enje ESXiArgs i Nevada ransomware napada.\u00a0 Ranjivosti se iskori\u0161tavaju za izvr\u0161avanje proizvoljnog programskog koda u sustavima (engl. remote code execution \u2013 RCE). Naj\u010de\u0161\u0107e se radi o CVE-2021-21974 ranjivosti. OpenSLP (port 427), koji je naj\u010de\u0161\u0107e razlog kompromitacije, kori\u0161ten u ESXi hipervizoru sadr\u017ei [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":1293,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":[],"meta":{"_acf_changed":false,"footnotes":""},"categories":[27],"tags":[],"tema":[],"class_list":["post-820","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ranjivosti"],"acf":[],"_links":{"self":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/820","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/comments?post=820"}],"version-history":[{"count":1,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/820\/revisions"}],"predecessor-version":[{"id":1296,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/posts\/820\/revisions\/1296"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media\/1293"}],"wp:attachment":[{"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/media?parent=820"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/categories?post=820"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tags?post=820"},{"taxonomy":"tema","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/tema?post=820"},{"taxonomy":"format","embeddable":true,"href":"https:\/\/cert.hr\/en\/wp-json\/wp\/v2\/format?post=820"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}