-
SAP Security Patch Day – March 2021: Don’t forget check your business client software.
Preface: In SAP Business Client history, rare to offer a Chromium web browser control based on CefSharp (CEF – Open Source Version of Google Chrome) as an alternative rendering engine to Microsoft IE. In 2018, the dream come true happened. SAP business clinet software technical background: If local client web browser not work, SAP client…
-
One step closer – Remedy of SaltStack design weakness (8th Mar, 2021)
Preface: SaltStack was acquired by VMware on October 13, 2020. All SaltStack commercial information can be found on VMware.com. For the Salt open source project, visit saltproject.io Background: SaltStack is a configuration management and orchestration tool. It uses a central repository to configure new servers and other IT infrastructure in Cloud computing environment. It can…
-
Sometimes internal threats are more dangerous than external anonymous threats! (7th March 2021)
Preface: In computing, ioctl (an abbreviation of input/output control) is a system call for device-specific input/output operations and other operations which cannot be expressed by regular system calls. Background: The ioctl design for public is considered bad for numerous reasons. And therefore some people suggest replace ioctl with Netlink. Netlink is a very good way…
-
The vulnerability found in the Ethernet Frame Decoder component of Snort. It will impacts all versions of the popular open source intrusion prevention and intrusion detection system (IPS/IDS) prior to 2.9.17, said Cisco. (3-3-2021)
Preface: Snort is an open-source, free and lightweight network intrusion detection.The Snort Subscriber Ruleset is developed, tested, and approved by Cisco Talos. Background: Sourcefire, Inc was a technology company that developed network security hardware and software. The company’s Firepower network security appliances were based on Snort. Snort has three primary uses: As a packet sniffer…
-
The famous MSS became a victim. Is it attacked by Maze Ransomware (3rd Mar, 2021)
Background: On July last year (2020), Secret Service warned that since MSPs service a large number of organizations at the same timethrough remote administration tools, cyber criminals are specifically targeting MSPs to conduct their attacks at scale to infect multiple companies through the same vector. Incident details: CompuCom began contacting customers to alert them that…
-
Microsoft fixes actively exploited Exchange zero-day bugs attacks (2nd Mar 2021). When service you are not in used, you should disable immediately.
Preface: The Microsoft Exchange Unified Messaging service on the Mailbox server will accept connections from a Client Access server on SIP ports 5062 and 5063. Technical background: Unified Messaging (UM) enables users to use voice mail and other features, including Outlook Voice Access and Call Answering Rules. UM combines voice messaging and email messaging into…
-
CVE-2021-25296 – Nagios XI version xi-5.7.5 is affected by OS command injection. (1st Mar, 2021)
Preface: Vulnerabilities are inevitable! For instance , the injection vulnerability will be managed by detective control. As usually, conducting remediation is the preventive and corrective control. To cope with reality, found and fix concept will be reduce the effectiveness of Defense concept. Zero Trust solution will be applied soon or later especially endpoint environment. Background:…
-
Security Focus: VMware vCenter Server remote code execution vulnerability in vSphere client (CVE-2021-21972) – 24th Feb, 2021
Background: The earlier release of vRealize Operations Manager with vCenter Server was shipped with the NGC plugin. The new vRealize Operations Manager plugin in vCenter Server, provides a mechanism to provide specific metrics and high-level information about data centers, datastores, VMs, and hosts, for the vCenter Server and vSAN. The plugin is supported only in…
-
Design weakness on RPC service awaken your alert! (24th Feb 2021)
Background: Remote Procedure Call (RPC) TCP port 135 is used for client-server communications by Microsoft Message Queuing (MSMQ) as well as other Microsoft Windows/Windows Server software.Allowing unrestricted RPC access on TCP port 135 can increase opportunities for malicious activities such as hacking (backdoor command shell). Recent RCP-related vulnerabilities in software product:CVE-2020-11635: The Zscaler Client Connector…
-
Would it be possible? Malware attack Apple M1 chip? – 21st Feb 2021
Preface: Can M1 chip run Windows? It is unsupported. the M1 decided not to use Boot Camp. Therefore it is not possible running Windows on Macs! Background: So called “System on a Chip”, M1 integrates several different components, including the CPU, GPU, unified memory architecture (RAM), Neural Engine, Secure Enclave, SSD controller, image signal processor,…