-
Ransomware hits Jack Daniel’s, said Bloomberg News – August 15, 2020
Preface: Whiskey production involves multiple procedures carried out in potentially hazardous atmospheres. LB Remote I/O System connects sensors and actuators to the DCS via PROFIBUS. In terms of application, DCS is suitable for whisky production and complex control processes. Incident background: Brown-Forman Corp., a manufacturer of alcoholic beverages including Jack Daniel’s and Finlandia, said it…
-
Apache release security advisory for struts 2 (aug 2020)
Preface: Struts2 OGNL is the expression language. OGNL is tightly coupled in Struts2 and used to store form parameters as java bean variables in ValueStack and to retrieve the values from ValueStack in result pages. ActionForm has the following responsibilities:Perform data security verification to prevent malicious data from entering the application. Vulnerability details: However, it…
-
New Linux malware – aka Drovorub (13th Aug 2020)
Preface: New Linux malware silently conducting the attack. The FBI and NSA issue joint security alert. Official announcement – https://media.defense.gov/2020/Aug/13/2002476465/-1/-1/0/CSA_DROVORUB_RUSSIAN_GRU_MALWARE_AUG_2020.PDF Remedy: To prevent attacks, the agency recommends that US organizations update any Linux system to a version running kernel version 3.7 or later, “in order to take full advantage of kernel signing enforcement,” a security…
-
SAP completes the remediation – Let’s review the flaw – CVE-2020-6286
Preface: Path traversal vulnerability perhaps will be ignore by some people. But this design weakness similar provide a channel to attacker conduct a search. The vulnerability described in SAP security notes 2934135 contains with two different vulnerabilities. Background: SAP NetWeaver is a software stack for many of SAP SE’s applications.It can be used for custom…
-
Cyber security Focus – IE Scripting Engine Memory Corruption Vulnerability (11th Aug 2020)
Preface: In Windows 10, there are two ways to uninstall Internet Explorer. Option 1:Turn Windows features on or off optionOption 2: Disable IE11 using PowerShell commands Open PowerShell and Run as administrator. Execute the following command:Disable-WindowsOptionalFeature -FeatureName Internet-Explorer-Optional-amd64 –Online Security Focus: CVE-2020-1380 – Scripting Engine Memory Corruption Vulnerability Even you turn off the Internet Explorer,…
-
CVE-2020-5413: vmware (kryo_codec) – Deserialization of Untrusted Data (Aug 2020)
Preface: Serialization in Java is a mechanism of writing the state of an object into a byte-stream. It is mainly used in Hibernate, RMI, JPA, EJB and JMS technologies. The reverse operation of serialization is called deserialization where byte-stream is converted into an object. Product background: Spring Integration framework provides Kryo Codec implementations as an…
-
c-ares 1.16.0 (Use-After-Free) – 9th Aug 2020
Preface: c-ares 1.16.0: ares_destroy() with pending ares_getaddrinfo() leads to use-after-free Background: Google added support for a feature known as asynchronous DNS to Google Chrome, which aims to speed up page loading times by resolving the IP address of a website before you click the link.Recent versions of Google Chrome employ a feature called Async DNS.…
-
DLL Hijacking vulnerability and the Remedy solution – 7th Aug 2020
Preface: Software application could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need to have valid credentials on the Windows system. Vulnerability details: If workstation install Python, by default it will install on the C Driver :\directory instead of the C Drive:\Program Files. Therefore the…
-
Operation technology environment – Staying Alert! (CVE-2020-15492)
Preface: Computer technology enlightens the automation industry. Due to modern CNC (Computer Numeric Control) technology, tiny parts are easy to produce. Who is the hero of this industry? I believe it is CAD technology. Background: CAD administrators use INNEO “Startup TOOLS” to manage working environments including licenses and standardized library elements and maintain their correct…
-
Express-fileupload module design weakness (CVE-2020-7699) – 4th Aug 2020
Preface: A large number of mobile apps and websites allow users to upload profile pictures and other files. Therefore, handling files upload is a common requirement while building a REST API with Node.js & Express (Express-fileupload). Express-fileupload is a middleware. Technical background: How express-fileupload works? It makes the uploaded files accessible from req[.]files property. For…