-
About CVE-2021-44228 & CVE-2021-4097 (12th Dec 2021)
Preface: We like Java and sometimes we hate it. People think that the php programming language will be eliminated, but there are still many people still using it. Background: Apache is a pioneer in occupying the Web server platform market. Over time, people worry about the weaknesses of the Apache overall design. So a group…
-
Fix for CVE-2021-41773 in Apache HTTP Server 2.4.50, it still require fine tune. (9th Dec 2021)
Preface: Some people say that CGI-Bin is a historical site. Today’s onerous security environment, perhaps not people use it. The truth tell us is that CGI-Bin still have space for survival. Background: About two months ago, the proof of concept for CVE-2021-41773 (Apache 2.4.49 & 2.4.50) vulnerability was released. The remedy solution is modify the…
-
aBOUT cve-2021-41014 – Do you think the key element will be given by Java? (8th Dec, 2021)
Preface: Perhaps we still remember a denial of service tool so called slow http attack. It can easily to make a Apache server out of resources less than minute. UTM firewall contains many components. For example, SSL VPN gateway. From technical point of veiw, this module also similar a HTTPS web server. If it contain…
-
About IOCTL handlers (Buffer Copy without Checking Size of Input (Classic Buffer Overflow)) – 7th Dec 2021
Preface: If it is a integer, just use it directly. If it is a pointer, need to check for valid user address: int access_ok(int type, const void *addr, unsigned long size); Background: IOCTL is referred as Input and Output Control, which is used to talk with device drivers. IOCTL is a system call where system…
-
Certain versions of WebHMI from Distributed Data systems has vulnerabilities occurs.The manufacturer recommends upgrading to version 4.1. (6th Dec 2021)
Preface: CISA Releases Security Advisory on WebHMI Vulnerabilities – https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03 Background: The company Distributed Data Systems LLC is well-known in Ukraine and abroad for products with WebHMI and 7bit brands for remote monitoring and control of industrial equipment in Industry 4.0 format. Remark: 7Bit ModBus Proxy is a caching gateway from ModBus TCP protocol to…
-
The evasion technique of Ring 3 continues to improve. Since this is the entry point. Therefore Layer 7 with deep packet inspection is the bases for defensive technique. (6th Dec 2021)
Preface: In fact, despite the excel icon, the XLL file is a Dynamic Linked Library, a binary executable file. Background: The number of data breaches as of September 30, 2021 has exceeded 17% of the total number of incidents in 2020 (1,291 breaches in 2021, and 1,108 breaches in 2020). The fundamental objective of MS…
-
RAT targeting Nginx. Can we say that NGINX is secure than Apache? (2-12-2021)
Preface: dlopen() The function dlopen() loads the dynamic shared object (shared library) file named by the null-terminated string filename and returns an opaque “handle” for the loaded object. Background: NGINX Plus provides a supported and tested version.Starting at $2500 per year. NGINX is an open source software. Dynamic modules add functionality to NGINX Plus such…
-
CVE-2021-38575 – NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. For a bug discovered half a year ago, CVE assigned a CVE number this month.(1-12-2021)
Preface: If a network interface controller is intended to be used as a boot device for a UEFI operating system or UEFI applications, then a UEFI Driver must be implemented that produces Network Interface Identifier Protocol and UNDI, the Simple Network Protocol, or the Managed Network Protocol. Background: Tianocore EDK II is the UEFI reference…
-
CVE-2021-41256 The Android version of the Nextcloud news app has security issues (30-11-2021)
Preface: Nextcloud is a suite of client-server software for creating and using file hosting services. It is enterprise-ready with comprehensive support options. Being free and open-source software, anyone is allowed to install and operate it on their own private server devices. Background: The Nextcloud News Reader App makes it possible to synchronize feeds between Android…
-
About CVE-2021-3802, Fedora & Ubuntu already address this matter, it is a reminder (29-11-2021).
Preface: (2021-07-30) Reported to KDE and GNOME development teams – In response, patches for both kio and glib were implemented.However, both projects rely mainly on udisks and use own code only as fallback. Background: Ubuntu used to have Unity desktop in its default edition but it switched to GNOME desktop since version 17.10 release.Ubuntu offers…