-
F-secure internet gatekeeper 5.40 (heap overflow) – 30th Jan 2020
Preface: Heap overflows are exploitable in a different manner to that of stack-based overflows. Memory on the heap is dynamically allocated at runtime and typically contains program data. Product background: F-Secure Internet Gatekeeper for Linux, aim to serve for small and medium business cyber security protection services. It capable to scanning incoming and outgoing including…
-
The endless story of the SMTP gateway – CVE-2020-7247
Preface: Ray Tomlinson sent the first email across a network, initiating the use of the “@” sign to separate the names of the user and the user’s machine in 1971, when he sent a message from one DEC-10 computer to another DEC-10. Synopsis: An SMTP relay is a protocol that allows email to be transmitted…
-
Digital transformation – coronavirus phishing scam email – Feb 2020
Synopsis: Staying alert especially to healthcare and pharmaceutical industry. Condemn this phishing scam email similar to harm ordinary people during this period of time. Observation: A sample phishing email detected last Tuesday, by email filter expert firm (Mimecast), shows cyber criminal send email with malicious links and PDFs that claim to contain information on how…
-
Can it be remedied or is it a enigma? – JAN 2020
Preface: User Account Control (UAC) is a fundamental component of Microsoft’s overall security vision. UAC helps mitigate the impact of malware. Synopsis: UAC Bypass Using eventvwr.exe was exploited by malware in 2017. Microsoft fixes Eventvwr.exe UAC Bypass Exploit in Windows 10 Creators Update. In Windows 10 Creators Update preview build 15007, Microsoft seems to have…
-
FusionAuth 1.10 Remote Command Execution – JAN 2020
Preface: The biggest differentiator between CIAM and regular (internal) IAM is that in CIAM the consumers of the service manage their own accounts and profile data. Background: FusionAuth provides all of the features you need without the need to code plugins or purchase an enterprise license. It also capable for SaaS architecture provides maximum flexibility…
-
Are there other similarly vulnerability component like ws2ifsl.sys in Windows?
Preface: You found an error in somewhere, sometimes will be expanded your idea of thinking. Synopsis: Ws2ifsl.sys is found in the C:\Windows\System32\drivers directory. In many cases, a driver creates a symbolic link and its name can be used as a file name for CreateFileA, but this is not the case with ws2ifsl. It only calls nt!IoCreateDevicewith the…
-
CVE-2020-2696 Local privilege escalation via CDE dtsession – JAN 2020
Technical Background: How to manages a CDE session? The dtsession command provides session management functionality, compliant with ICCCM 1.1, during a user session, from login to logout. It starts a window manager and allows users to save a session, restore a session, lock a session, start screen savers, and allocate colors for desktop-compatible clients. Vulnerability…
-
NewsOne design weakness – Arbitrary File Upload (18th Jan 2020)
Preface: Arbitrary File Upload but require regular user sign in. Perhaps it lose the access control! Product description: NewsOne is a web based application and fully responsive news & magazine script. Anyone can start your own media/press website with just few clicks without any codding knowledge. Vulnerability details: Auth as a regular user. Go to…
-
MS CryptoAPI spoofing flaw – 15th Jan 2020
Preface: We are all scared of Ransomware! Background: crypt32.dll is a type of DLL file, with extension of .dll. It is associated with Crypto API32 and is used to run Crypto API32 based applications. Certain sophisticated video games and software applications use crypt32.dll to get access to certain API functionality, as provided by Windows. Vulnerability…
-
Return to basis – access control (CVE-2020-3941) – Jan 2020
Preface: A race condition allows an attacker to access a shared resource, which can lead to an attack by other participants using the resource. Background: VMware Tools is a set of services and modules that enable several features in VMware products for better management of, and seamless user interactions with, guests operating systems. Vulnerability details:…