VMWare management agent borked from Openvas default cred testing

The following of Read Before Use is matching quite good here:

Remember that triggering faults, crashes or locking with default settings means that an attacker can do the very same at unplanned times and to an unplanned extent. Finding out about it earlier than the attacker is the key to resilience.

If a device / system / software is crashing while being scanned it is recommended (Especially when using the Non-Ultimate Scan Configs) to contact the vendor of this device / system / software about possible issues / vulnerabilities in the used product. A verification if there are newer updates / versions available and (if available) and update to those might already help to mitigate such issues.

Once the vendor acknowledge an issue you could enable the log_whole_attack setting of the scanner and watch the mentioned logfiles to see which VT was active at the point of the crash so that the vendor might be able to reproduce this behavior.

1 Like