-
Vulnerability might jeopardize IoT world – CVE-2019-10160 Python Security Regression Unicode Encoding Vulnerability (Jun 2019)
Preface: IoT device similar a delivery arm of robotic concept. They are the python language heavy duty users. Python language married with IoT devices – For IoT, there has been a variant of python called Micropython , that lets you program for IoT in Python. Additionally, developer can use Raspberry Pi to program your IoT…
-
It will jeopardizing 400,000 Linux system in the world – Exim Releases Security Patches (alert issued in Jun 2019)
Preface: Exim is growing in popularity because it is open source. Background:It’s the default mail transport agent installed on some Linux systems.It contain feature likes: Lookups in LDAP servers, MySQL and PostgreSQL databases, and NIS or NIS+ services. Vulnerability details: The vulnerability was patched in Exim 4.92, released on February 10, 2019. The vulnerable code…
-
CVE-2019-3567 osquery design flaw – unintended create hidden place for malware Jun 2019
Preface: Need to know what processes are running on a given machine? A servers current CPU temperature? Verify a hard drive is encrypted? OSQUERY can do, even though security monitoring. Technical background: osquery is a tool that exposes an operating system as a high-performance relational database.The design founded by Facebook. It enables developers to write…
-
CVE-2019-12243 Istio improper internet access control vulnerability (Jun 2019)
Preface: Independently deployable is the strongest feature of microservices. Docker is one of the technology vendor keen to develop the microservice. What is Istio? An open platform to connect, manage, and secure microservices. Istio is easy to deploy. User merely install a proxy (side-car proxy) and complete the configuration. Vulnerability details: The vulnerability was impacting…
-
It looks very vague – Oracle Vulnerability CVE-2019-2517 (Jun 2019)
Preface: Every time you review Oracle security advisory. Your feeling is vague since no details will be provided! Vulnerability details: A vulnerability in the Core RDBMS component of Oracle Database Server could allow an authenticated, remote attacker with high privileges to compromise a targeted system completely. More details: The vulnerability resides in the Java Virtual…
-
Configure a strong PSK to avoid wireless offline cryptographic attack
Preface: Maybe people won’t use WPA because it’s not safe. However, WPA2 can also collect PSK through tools. Technical details: WPA and WPA2 offline attack technique are well known today. For instance, penetration test conduct the WiFi penetration test will relies on tool (Aircrack-NG). As a matter of fact, the attacker first obtains a man-in-the-middle…
-
Did you have trouble accessing internet on Sat (8th Jun 2019 GMT+8)
Synopsis: The users were temporarily unable to reach adjacent countries internet web sites for short period of time (less than 1 – 3 minutes) due to an issue of Internet BGP backbone. Description: On Sat, I was surprise that some internet web site looks unstable. It is not only happens on a single web site.…
-
We may ignore the vulnerabilities that happened in the past! Jun 2019
Preface: The virtual table is created in the same SQLite database in wich the Core Data content resides. To keep this table as light as possible only object properties relevant to the search query are inserted. Vulnerability details: A vulnerability in the rtreenode() function of SQLite3 could allow an unauthenticated, remote attacker to access sensitive…
-
CVE-2019-10981 AVEVA Security Advisory LFSEC00000136 (May 2019)
Preface: In the Ukraine hack, the utilities not only lost their visibility but also ceded control of their networks to remote attackers later linked to APT Group (Dec 2015). About AVEVA : AVEVA Group plc is a British multinational information technology company headquartered in Cambridge, United Kingdom. It provides engineering and industrial software. Schneider Electric…
-
Microsoft Windows RDP Network Level Authentication can bypass the Windows lock screen – Jun 2019
Vulnerability Note VU#576688 Original Release Date: 2019-06-04 | Last Revised: 2019-06-04 Preface: The more the power you have, the greater the risk is being infected. Synopsis: Microsoft Windows RDP Network Level Authentication can allow an attacker to bypass the lock screen on remote sessions. My observation: Observing that Microsoft re-engineering the RDP with create a…