Preface: A quick walk through on your VMware setup, see whether 3D acceleration feature is enabled. It is recommended to disabling the 3D-acceleration feature to protect your IT environment.

Vulnerability Details:
CVE-2019-5514 – Vulnerability due to certain unauthenticated APIs accessible through a web socket
CVE-2019-5515 – Out-of-bounds write vulnerability in the e1000 and e1000e virtual network adapters
CVE-2019-5518 – Out-of-bounds read/write vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface)
CVE-2019-5519 – Time-of-check Time-of-use (TOCTOU) vulnerability in the virtual USB 1.1 UHCI (Universal Host Controller Interface)
CVE-2019-5524 – Out-of-bounds write vulnerability in the e1000 virtual network adapter
CVE-2019-5516 – Vertex shader out-of-bounds read vulnerability
CVE-2019-5517 – multiple shader translator out-of-bounds read vulnerabilities
CVE-2019-5520 – out-of-bounds read vulnerability

Official announcement: https://www.vmware.com/security/advisories/VMSA-2019-0006.html

Checkpoint – Regarding to existing vulnerability reporting process, Zero day or new found vulnerabilities has grace period announce to public. Should you have doubts?
Check your managed services provider and identify how do they handling zero-day? For example: Microsoft Active Protections Program member will be know the windows zero day in advance 90 days. As such, you can using this indicator to choosen your MSS.

Preface: Who is cookie? Is it cookie monster? Multiple VPN applications insecurely store session cookies – 11th Apr 2019

Technical background: An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to the user’s web browser. The browser may store it and send it back with the next request to the same server. Typically, it’s used to tell if two requests came from the same browser — keeping a user logged-in, for example. It remembers stateful information for the stateless HTTP protocol.

Vulnerability details: The following products and versions store the cookie insecurely in memory:

• Palo Alto Networks GlobalProtect Agent 4.1.0 for Windows and GlobalProtect Agent 4.1.10 and earlier for macOS0 (CVE-2019-1573)
• Pulse Secure Connect Secure prior to 8.1R14, 8.2, 8.3R6, and 9.0R2
• Cisco AnyConnect 4.7.x and prior

Reference: https://kb.cert.org/vuls/id/192371/

My observation: A technical limitation on Clientless SSL VPN. If SSO authentication implement to clientless ssl VPN. The webbase VPN machine must keeps the cookie on behalf of the user and uses it to authenticate the user to secure websites within the domain protected by the SSO server. And therefore VPN applications might store the authentication and/or session cookies insecurely in memory.

Preface: MyCar add smartphone-controlled geolocation, remote start/stop and lock/unlock capabilities to a vehicle with a compatible remote start unit.

Vulnerability details:
MyCar Controls mobile applications prior to v3.4.24 on iOS and prior to v4.1.2 on Android contains hard-coded admin credentials. For specifics details, please refer to diagram.

Reference:https://kb.cert.org/vuls/id/174715/

Preface: Samba is an open-source software suite that runs on Unix/Linux based platforms. The design based on SMB network protocol. Samba is able to communicate with Windows clients like a native application.

Synopsis: Windows OS and Linux opensource looks contains their market. A trend shown that Linux base OS well develop in automation industry. Perhaps common printer not compatible with open source Linux. As a result, 3rd party service daemon is going to pick up this responsibility. In fact, vulnerability happens in IT world daily. It is rare that a software or hardware do not have vulnerability. And therefore Samba do not have exception.

Vulnerability details:

CVE-2019-3880 – path/symlink traversal vulnerability, For more details, refer to url.

https://www.samba.org/samba/security/CVE-2019-3880.html

CVE-2019-3870 – During the provision of a new Active Directory DC, some files in the private/ directory are created world-writable. For more details, refer to url.

https://www.samba.org/samba/security/CVE-2019-3870.html

Preface: Industrial Ethernet has been the network of choice in factory auto-mation for many years and offers a powerful communication basis with PROFINET-based solutions.

Vulnerability details: A vulnerability has been identified in Scalance X-200 (All versions), Scalance X-300 (All versions), Scalance XP/XC/XF-200 (All versions <V4.1). The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.

Impact: An attacker might use this behaviour to transmit malicious packets to systems in the mirrored network. The worst scanario is that it go direct to facilities like SIMATIC S7-400 advanced controller thus conducting cyber attack directly see whether can find zero-day of attack.

Siemens official announcement – refer to url: https://cert-portal.siemens.com/productcert/pdf/ssa-557804.pdf

Preface: The vulnerability if not require attacker conduct scam to persuade a user. It is a extreme dangerous vulnerability.

Technical background of Kubernetes: Kubernetes (often referred to as K8s) is an open source system for automatically deploying, extending, and managing containerized applications. The system was designed by Google and donated to the Cloud Native Computing Foundation (now the Linux Foundation).

Synopsis: The container escape vulnerability in runc awaken docker users in regard to cyber security in their domain. Perhaps the vulnerability of CVE-2019-1002101 is in high severity level. But strongly believed that it is an alert. Hey administrator, staying alert! Should you have interest receive a quick understanding, please refer to attached diagram.
Kubernetes has released software updates at the following link: https://github.com/kubernetes/kubernetes/releases

Alert: The Apache Software Foundation has released Apache HTTP Server version 2.4.39 to address multiple vulnerabilities.

• mod_auth_digest access control bypass (CVE-2019-0217)
• mod_ssl access control bypass (CVE-2019-0215)
• mod_http2, possible crash on late upgrade (CVE-2019-0197)

CVE-2019-0211 bring to my attention. For the synopsis of this matter, please refer to attached diagram.

Remedy: The Apache Software Foundation has released Apache HTTP Server version 2.4.39 to address multiple vulnerabilities. See the URL for more information.

https://httpd.apache.org/security/vulnerabilities_24.html

Preface: Today, the stored password is not encrypted like walking around without clothes!

Technical background: Portainer is a lightweight management UI which allows you to easily manage your different Docker environments (Docker hosts or Swarm clusters). It allows you to manage your all your Docker resources (containers, images, volumes, networks and more) ! It is compatible with the standalone Docker engine and with Docker Swarm mode.

Vulnerability: The affected software stores LDAP credentials in cleartext and performs insufficient security checks on API calls that allow the retrieval of LDAP credentials.

Remedy: Portainer has released software updates at the following url: https://github.com/portainer/portainer/releases/tag/1.20.0