-
Storm of Go language based malware – 6th May 2020
Preface: New Kaiji malware targets IoT devices via SSH brute-force. Background: Gobot is a framework for robotics, drones, and the Internet of Things (IoT), written in the Go programming language. Observation: Programmers usually choose Golang for building the communication layer within the IoT system. One of the biggest draws to Go is the fact that…
-
SaltStack has released a security update to address critical vulnerabilities affecting Salt versions prior to 2019.2.4 and 3000.2 (1st May 2020)
Product background: If you have one hundred servers, so it makes sense to use Puppet(open source DevOps systems management tool)for centralizing and automating the configuration management process. SaltStack itself is an open source infrastructure centralized management platform. Compared with other commercial products, its deployment and configuration are slightly more complicated. Vulnerability details: SaltStack has released…
-
Alert users that a previously disclosed Oracle WebLogic Server remote code execution vulnerability (CVE-2020-2883) is being exploited in the wild. (3rd May 2020)
Preface: Perhaps my alert late for 3 days, but the specify vulnerability hide himself in webLogic product for few years! Vulnerability details: Alert users that a previously disclosed Oracle WebLogic Server remote code execution vulnerability (CVE-2020-2883) is being exploited in the wild. You can read the official announcement in following link – https://blogs.oracle.com/security/apply-april-2020-cpu One of…
-
VMware ESXi patches address Stored Cross-Site Scripting (XSS) vulnerability (CVE-2020-3955) – 28th Apr 2020
Preface: Perhaps when you do the web scan or web penetration test. XSS will be easy to find out. However people has contempt this matter. How to avoid XSS happen? 1. Input should filter characters especially < > & ‘ ” . 2. Whitelisting and input validation are more commonly associated with SQL injection, they…
-
Juniper harden itself. Avoid log event services daemon encountered injection attack – 28th Apr 2020
Preface: Friendly speaking, the similar types of attack apply to all Linux base devices including firewall. The impact of this vulnerability – If J-Web is enabled, the attacker could gain the same level of access of anyone actively logged into J-Web. If an administrator is logged in, the attacker could gain administrator access to J-Web.…
-
An Official remediation was released (Avoid SQL injection attack encountered in Sophos XG Firewall) – 26th April 2020.
Preface: The modern user friendly functions installed on firewall impact his defense function. Background: When device provide web page input user credential, perhaps it will facing injection attack. Yes, it is. No matter, SQL injection or command injection. Especially like firewall design. It is capable support and integrate of LDAP authentication or standalone authentication mode.…
-
headline news – cyber attackers from exploiting web servers via web shell malware. 23rd Apr 2020
Preface: Web shells are a well-known attacker technique, but they are often difficult to detect because of their proficiency in blending in with an existing web application. Details: to gain root access to server. Web shells malware are frequently chosen by APT group; however these are just a small number of known used web shells.…
-
Buffer Overflow (SEH Bypass), perhaps it is easy to encounter in medical software system (20th Apr 2020)
Preface: IoT Enterprise runs on 32-bit and 64-bit x86 chipsets with support for Universal Windows Platform (UWP) apps as well as Classic Windows(e.g. Win32 and .NET) applications. Perhaps you will discover plenty of medical devices still use 32 bit windows application. Recent security alert on medical product: The ‘DICOM Viewer 2.0’ capable of handling all…
-
winducms – attacker exploit php feature cause sql injection and REC (20th Apr 2020)
Preface: Why we found vulnerability on apps in frequent? Fundamentally, apps goal provided services and function. Even though you said it is a design weakness. But protection control should relies on other separate service or component. It will increase the difficulties for attacker when you install the antivirus(malware) on your mobile phone. Vulnerability background: Windu…
-
Cisco security advisory – Multiple Vulnerabilities in Cisco UCS Director and Cisco UCS Director Express for Big Data (17-Apr-2020)
Preface: The protocols and the interfaces used by the controller to communicate with the application layer are called the Northbound interface. Protocols used for communication between the controller and forwarding nodes are called Southbound interface. Northbound communication is used to retrieve info or send instructions to the controller using APIs. Vulnerability details: Multiple vulnerabilities in…