Can Sophos AV block CVE-2021-21985 and CVE-2021-21986 on VMwares?

Hi Marvin Bauzon, 

I'll be checking with my team regarding this. But in the meantime, I highly recommend that you take actions based on these VMWare documents: 

1. https://core.vmware.com/resource/vmsa-2021-0010-faq

2. https://kb.vmware.com/s/article/83829

Hi Yashraj,

Any luck if the mentions CVEs are included on the IPS database of Sophos Enterprise 5.52?

Regards,

Marvin Bauzon

Hello Marvin,

to clarify a few things:

• on the IPS database of Sophos Enterprise 5.52 - the SEC version (and to a certain extent the SAV version as well) is irrelevant, HIPS configuration and rules are independently and  infrequently updated
• block  CVE-2021-21985 and CVE-2021-21986 - both are, if I understand correctly, vulnerabilities in plugins of vCenter Server and exploitable via port 443, specifically for CVE-2021-21986 a Man-In-The-Middle attack is a top attack pattern. Thus both don't fall within the remit of classic AV
• the purpose of CVEs is not: There's a CVE and my security software (and its vendor) will or should deal with it

Just my two cents
Christian

Hi Marvin Bauzon,

We've already released signatures for this vulnerability for our Firewalls as this exploit has more interaction on the network side. This is correctly pointed out by QC's response.