6 vulnerabilities in some Huawei products – The culprit,SOAP!

The Simple Object Access Protocol (SOAP) invoking objects on remote machine.
It is XML-based messaging thus run on top of HTTP/HTTPS.
That is the reason why firewall cannot significant block them.

An announcement issued by HUAWEI. For more details, please refer below url for reference.

Security Advisory – Six Vulnerabilities in Some Huawei Products

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-01-soap-en

Attention: Stay Alert – Multiple Vulnerabilities in PHP Could Allow for Arbitrary Code Execution

Preface:

PHP is a widely-used open source general-purpose scripting language that is especially suited for web development and can be embedded into HTML.

Security concern by security experts

The security issues are typically exposed when PHP code makes use of system-level calls.

Found critical security problem today! – Original release date: April 27, 2018

The Multi-State Information Sharing & Analysis Center (MS-ISAC) has released an advisory on multiple Hypertext Preprocessor (PHP) vulnerabilities. An attacker could exploit one of these vulnerabilities to take control of an affected system.

NCCIC encourages users and administrators to review MS-ISAC Advisory 2018-046 and the PHP Downloads page and apply the necessary updates.

See whether any short term remediation can take before upgrade?

1.Restrict PHP Information Leakage

expose_php=Off

2.Disable Remote Code Execution

Allow_url_fopen=Off

allow_url_include=Off

3.Not show errors to the visitors

(/etc/php.d/security.ini file)

log_errors=On

error_log=/var/log/httpd/php_scripts_error.log

4.Disable Dangerous PHP Functions (php.ini)

disable_functions =exec,passthru,

shell_exec,system,proc_open,popen,curl_exec,

curl_multi_exec,parse_ini_file,show_source

5.Upload Files (/etc/php.d/ directory)

file_uploads=Off

6.Control File System Access

always keep the open_basedir directive set to the /var/www/html directory.

open_basedir=”/var/www/html/”

7.Control the POST Size (/etc/php.d/security.ini)

post_max_size=1k

— End —

Attention: PeopleSoft Enterprise PeopleTools (Rich Text Editor) vulnerability – Apr 2018

CVE# Product Component Protocol Remote
Exploit
without
Auth.?
CVSS VERSION 3.0 RISK (see Risk Matrix Definitions) Supported Versions Affected Notes
Base
Score
Attack
Vector
Attack
Complex
Privs
Req’d
User
Interact
Scope Confid-
entiality
Inte-
grity
Avail-
ability
CVE-2018-2772 PeopleSoft Enterprise PeopleTools Rich Text Editor HTTP No 8.8 Network Low Low None Un-
changed
High High High 8.54, 8.55, 8.56

Attention: CVE-2018-2772

Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data.

Official announcement shown below url for reference.

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

CVE-2018-0229: See whether is there any attack make use of this vulnerability transform another type of attack in future?

Seems firewall administrator do not take the single sign-on authentication method in firewall. Perhaps it can’t fulfill audit requirement.  Cisco found SAML Authentication Session Fixation Vulnerability. The vulnerability exists because there is no mechanism for the ASA or FTD Software to detect that the authentication request originates from the AnyConnect client directly. An attacker could exploit this vulnerability by persuading a user to click a crafted link and authenticating using the company’s Identity Provider (IdP).  My concerns is that see whether is there any attack make use of this vulnerability transform another type of attack in future?

Cisco Official announcement is shown as below:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asaanyconnect

Be alert! Vulnerability in the Java SE, Java SE Embedded and JRockit component of Oracle Java SE (subcomponent: Serialization). 

The security concerns on CVE-2018-2815, please staying alert. For more details, please see below:

  1. The Java Security Architecture (JSA) defines ways for unprivileged code to perform privileged operations using

AccessController.doPrivileged().

2. The method includes create a new PrivilegedIntrospectHelper.

3. The new PrivilegedIntrospectHelper will be executed on a privileged block. This block will all internalIntrospecthelper(bean,prop,value,request,param,ignoreMethodNF) which will allow to invoke encapsulation (setter).

4. Result:

With encapsulation we pretend that nothing is revealed about the internal representation of an object, and we interact with our components only through their public interfaces; a desirable attribute that we usually exploit later when we want to change the internal representation of data in a component without breaking any code from its users.

Official security update show as below url:

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

 

 

Hackers jailbreak MyEtherWallet Infrastructure (Apr 2018)

ISPs tend to restrict what an end customer can advertise. However, any ISP do not filter customer advertisements.
A possible factor let’s hacker compromise the customer router thus advertise errant information into the global routing table.

An attackers stolen at least $13,000 in Ethereum within two hours.

Security expert speculate that it is a DNS attack. But many attack method can be used. For example: BGP hijacking. The scenario displayed on above diagram.

Headline news shown as below:

https://www.theverge.com/2018/4/24/17275982/myetherwallet-hack-bgp-dns-hijacking-stolen-ethereum

 

 

 

 

 

 

Apple security updates (Apr 2018)

My speculation on iOS 11.3.1 show on picture.This is the moment when silence is more expressive than all words ever spoken. For more details about official announcement. Please see below url for references:

About the security content of iOS 11.3.1

About the security content of Safari 11.1

https://support.apple.com/en-us/HT208741

About the security content of Security Update 2018-001

https://support.apple.com/en-us/HT208742

Schneider Electric Important Security Notification – Mar & Apr 2018

 

A flaws found in Schneider Electric’s Modicon M340 PLC Station P34 Module human machine interface (HMI) software since 2015. An official announcement by vendor since last month till now. From techincal point of view, Modicon product series programmable logic controller has large usage in electric, gas and oil supply industry. So related party must stay alert!

CVE-2018-7758: https://download.schneider-electric.com/files?p_enDocType=User+guide&p_File_Name=SEVD-2018-074-04+MiCOM+Px4x+Rejuvenated.pdf&p_Doc_Ref=SEVD-2018-074-04

CVE-2018-7762: https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-081-01+Modicon+V1.2.pdf&p_Doc_Ref=SEVD-2018-081-01

CVE-2018-7759: https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Id=9601432352&p_File_Name=SEVD-2018-081-02+Modicon.pdf&p_Doc_Ref=SEVD-2018-081-02

CVE-2018-7242: https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-081-01+Modicon+V1.2.pdf&p_Doc_Ref=SEVD-2018-081-01

CVE-2018-7760 & CVE-2018-7761: https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Id=9601432352&p_File_Name=SEVD-2018-081-02+Modicon.pdf&p_Doc_Ref=SEVD-2018-081-02

CVE-2018-7240 & CVE-2018-7241: https://download.schneider-electric.com/files?p_enDocType=Technical+leaflet&p_File_Name=SEVD-2018-081-01+Modicon+V1.2.pdf&p_Doc_Ref=SEVD-2018-081-01

Cisco Firepower vulnerabilities – Apr 2018

The content filter features enhance the firewall defense function. At the same time it is hard to avoid the design limitation occurs in this place. And therefore vulnerabilities occurs!

Vulnerabilities  details shown as below:

CVE-2018-0233: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fpsnort

CVE-2018-0272: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-firepower

CVE-2018-0254: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fss2

CVE-2018-0244: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fss1

CVE-2018-0243: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fss

CVE-2018-0230: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-fp2100