The software expert keen to reduce memory footprint and improve their application performance.Java code can run on different systems, because it relies on the JVM, not on the operational system itself. This is the powerful function of Java plus JVM. Meanwhile, it let’s Java application developers and end users spreading around in the world. The virtual machine creates an independent platform on top of the operating system. Similar the situation of Docker in today’s cloud computing.The JVM is a “simulated machine” that can be installed on different systems.  Furthermore, if vulnerability occurs in JVM. It will jeopardizing the related system facilities since the application run on top of JVM.

CVE-2018-12539 – In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code.

Remediation – Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option –Dcom.ibm.tools.attach.enable=no.

ABout the details CVE-2018-12539 : https://bugs.eclipse.org/bugs/show_bug.cgi?id=534589

Additional CVE-2018-12537: https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038

A regular expression (regex or regexp for short) is a special text string for describing a search pattern. We can’t lack of this function in IT world. For example, your SIEM log parser and Web server input protection filter.

Eventhough if you want to represent a group of Strings according to a particular pattern then you should go for Regular Expression. Just heard that the regular expression function can be modify by attacker.Then conduct denial of service attack.

I download node.js package do the proof of concept. It looks that it is ture. For more details, please reference to attached diagram. Java is also known to be affected by ReDoS attacks.

Technical articles shown as below:

http://people.cs.vt.edu/dongyoon/papers/EUROSEC-17-EHP.pdf

Sometimes the situation of the technology world similar a people stand in the cross road. For instance, you relies on remote access to do your work. We relies SSL/TLS so far. Now we know SSL TLS 1.0 not safe and advice to use TLS 1.1 and 1.2. VPN (virtual private network) like a mandatory interconnect of our life daily. We known already that VPN with IKEv1 aggressive mode not safe. How about IKEv1 main mode situation? The world tell the truth this week. IKEv1 Main Mode vulnerable to brute force attacks. The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. (CVE-2018-5389). The fact is that an attacker may be able to recover a weak Pre-Shared Key (weak shared secret).

Offical details shown below reference hyperlink.

https://www.kb.cert.org/vuls/id/857035

Apache and Tomcat is a perfect match. Their relationship similar pianist and piano. We can’t lack of music in our life. On the other hand, IT world can’t without Apache and Tomcat. But Tomcat is sick today. Found the Apache Tomcat Native (1.2.0 to 1.2.16 and 1.1.23 to 1.1.34) has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. As a result, revoked client certificates may not be properly identified. It allow suspects to authenticate with revoked certificates to connections that require mutual TLS. Native connector use OpenSSL for SSL/TLS function. Refer to attached diagram. If such vulnerability occurs, in the sense that the suspects can control the whole system. It is hard to imagine that how worst will be the IT shop using multiple vhost setup (see below specifications)!

Tomcat 8 supports
one TLS virtual host per connector
one certificate per virtual host

Tomcat 9 supports
multiple virtual hosts per connector (SNI)
multiple certificates per virtual host

For more details, please reference to official announcement.

http://tomcat.apache.org/security-native.html#Not_a_vulnerability_in_the_Apache_Tomcat_APR/native_Connector

Android and iOS apps contain multiple vulnerabilities:

Original Release date: 14 Aug 2018 | Last revised: 15 Aug 2018

Google apps store and App Store (iphone) enforce security policies last year get rid the suspected malicious apps in their store. From customer point of view, it looks better because this is the soure download location. It will avoid the malware infection. A efficency way to avoid cyber security accident and data breach in mobile devices world. However there is another way to evade your phone security setting. What is the way? The OEM vendor pre installed apps like a backdoor. Let’s the Android and iOS apps embed a hard-coded cryptographic key bypass the original security settings.

US-CERT security alert – please refer below url:

https://www.kb.cert.org/vuls/id/787952

Vulnerability Note VU#641765 – 14 Aug 2018

Linux kernel IP fragment re-assembly vulnerable to denial of service

Cyber security guy includes myself really tired last few days. Found Linux kernel IP fragment re-assembly vulnerability today. It causes denial of service. It looks that computer appliances vendor not confirm this vulnerability on their product yet.
If you are really concern. Please review below parameters. You can do it manually to remediate this issue. If it works, please thank you to ultraman.

echo 393216 > /proc/sys/net/ipv4/ipfrag_low_thresh
echo 544288 > /proc/sys/net/ipv4/ipfrag_high_thresh

sysctl -w net.ipv4.ipfrag_low_thresh=393216
sysctl -w net.ipv4.ipfrag_high_thresh=544288

CERT technical articles for reference – https://www.kb.cert.org/vuls/id/641765

Security authorities announced total 2 items of high severity vulnerabilities from cisco products today. IT Guy must stay alert!

1. Cisco Web Security Appliance Web Proxy Memory Exhaustion Denial of Service Vulnerability

Cisco AsyncOS Operating System started with a FreeBSD kernel and made three major changes to create the Cisco Email Security appliance.

One of the possibility:

A design limitation on FreeBSD is that When network packets making up a TCP segment are received out-of-sequence, these packets are held in a reassembly queue on the destination system so that they can be re-ordered and re-assembled. By sending a large number of out-of-sequence TCP packets, an unauthenticated, remote attacker could exhaust all memory buffers (mbufs) on the destination system resulting in a denial-of-service condition.

Offical announcement shown as below:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-wsa-dos

2. Unified Communications Manager IM & Presence Service Denial-of-Service Vulnerability. Offical announcement shown as below:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180815-ucmimps-dos

From technical point of view, the Intel CPU design limitation jeopardize downstream product vendor. VMware is one of the vendor do the remediation immediately. A memory bank built into the CPU chip. Also known as the “primary cache,” an L1 cache is the fastest memory in the computer and closest to the processor. Let’s think it over? If memory is allocated by the VMkernel and virtualized by monitor. CPU is controlled by scheduler and virtualized by monitor. If address translations may allow unauthorized disclosure of information residing in the L1 data cache? So, the attacker with local user access with guest OS privilege via a terminal page fault and a side-channel analysis equilvant as a monitor.

As such , VMware do the following:

https://www.vmware.com/security/advisories/VMSA-2018-0020.html

An official announcement state that there are three more data-leakage security holes found in Intel chips:

• CVE-2018-3615 – L1 Terminal Fault: SGX
• CVE-2018-3620 – L1 Terminal Fault: OS/SMM
• CVE-2018-3646 – L1 Terminal Fault: VMM

Across the board, Intel’s desktop, workstation, and server CPUs are vulnerable.

Official announcement shown as below:

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html

Reminder: I am using window 7 instead of windows 10. In retrospect, I did patch management which focus for spectre on Jan 2018. It behind my seen that CPU vulnerability still valid on my PC. The cache-misses as compared to missed-branches data collected from Spectre is possible on my PC (see attached screen-shot for reference). So I believe that this flaw (L1TF) substained. Furthermore the vendor known earlier. May be the vendor believe that this is the appropriate timeframe to announce.

Below historical record for reference:

CPU vulnerability remediation status update – especially Spectre