-
Jul 2018 – Siemens Security Advisory by Siemens ProductCERT
Selective Availability (SA) was an intentional degradation of public GPS signals implemented for national security reasons. In May 2000, at the direction of President Bill Clinton, the U.S government discontinued its use of Selective Availability in order to make GPS more responsive to civil and commercial users worldwide. And therefore the GPS open to public…
-
Jul 2018 – The IoT P2P (Peer to Peer) design flaw let passwords of over 30,000 devices exposed in search engine
The P2P (Peer to Peer) function is common function for the operation support for Internet of things devices. It aim to simplify the operation and increasing flexibility. We now focusing on data personal privacy but the fundamental of user friendly functions looks contained contradiction with secure operation. The firm (NewSky security) found password for tens…
-
New version of black energy cyber attack target Microsoft OLE product design weakness
Ukrainian intel agency has claimed it stopped a cyber attack against a chlorine plant that was launched using the notorious VPNFilter malware. Perhaps the world focusing VPN filter malware spreading and infection. We known earlier last month that such attack targets are the low end wireless router and network access storage (NAS). However, from my…
-
12th Jul 2018 – ISC Kea 1.4.0 failure to release memory may exhaust system resources
CVE-2018-5739: ISC Kea 1.4.0 failure to release memory may exhaust system resources Hook/Hook Point – used interchageably, this is a point in the code at which a call to user functions is made. Each hook has a name and each hook can have any number (including 0) of user functions attached to it. Store leases…
-
Integer overflow weakness similar kill the Ethereum. But SafeMath to protect from overflows.
Integer overflow weakness similar kill the Ethereum – for more details, please see below (url): Jul 2018 – Integer overflow may killed Ethereum! But SafeMath to protect from overflows. c >= a causes integer overflow happen arithmetic: c=a+b-M (where M = 2**256 is the max unit256 plus one) If c >=a replace to get a…
-
Jul 10, 2018 MS Patch Tue – MS Office
MS Patch Tuesday sometimes really annoying. What’s the root causes we encountered vulnerability weekly? But we require to do the patch if you would like to using your computer with security protection instead of cyber security victim. One of the security update targeting to resolves vulnerabilities in Microsoft Office that could allow remote code execution…
-
Jul 2018 – Integer overflow may killed Ethereum!
Quote: Attacker passes int greater than max (positive) –> value wraps around to the min (negative!) Can cause unexpected program behavior, possible buffer overflow exploits The existing market cap of Ether (ETH) is more than Ripple and Litecoin, although it’s far behind Bitcoin (BTC). Ethereum contains potential market power. But integer overflow is the…
-
July 2018 – CVE-2018-3754 All versions of query-mysql are vulnerable to SQL injection
As time goes by node.js and MYSQL database become another technology trend in IT world. Before Node.js, Javascript was only used for client-side development. It was necessary to use a different server-side programming language. Nowadays web applications deploy Javascript, making app deployment much easier and more efficient. But web application developer must staying alert. However…
-
Jul 2018 – PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file)
CVE-2018-12882 – PHP 7.2.x through 7.2.7 allows attackers to trigger a use-after-free (in exif_read_from_file) Use-After-Free vulnerabilities are a type of memory corruption flaw that can be leveraged by hackers to execute arbitrary code. Refer to statistic, PHP Version 5 is used by 82.0% of all the websites who use PHP. How about this vulnerable version?…
-
July 06, 2018 – Apple Releases Security Update for Boot Camp
WiFi connection seems secure when IT Department authenticating wifi users with windows active directory. A know issue told the world that WPA is not secure and therefore the WiFi authentication best practices jump to WPA2. From general point of view, we all focusing to WiFi access point, authentication protocol and encryption method. It looks that…