-
Previous NFS 4.1 vulnerability (CVE-2018-16884) show linux kernel design weakness.
Preface: A vulnerability in the NFS41+ subsystem of the Linux Kernel could allow an authenticated, adjacent attacker execute arbitrary code on a targeted system. The vulnerability exists because the bc_svc_process() function of the affected software uses the wrong back-channel ID. use-after-free in svc_process_common The defect not only affected software uses the wrong back-channel ID. Furthermore…
-
Closer look: CVE-2019-1162 Windows ALPC Elevation of Privilege Vulnerability
Preface: ALPC (Advanced/Asynchronous Local Procedure Call) is a C/S model technology developed by Microsoft to replace LPC for native RPC. Vulnerability details: Tasks created by the Task Scheduler will create the folder and file in “c:\windows\system32\ tasks”. This function original to be designed to write the discretionary access control list of the task in this…
-
THE GREATER THE POWER OF THE COUNTRY, THE STRONGER THE SUPERCOMPUTER.
Summit, launched in 2018, delivers 8 times the computational performance of Titan’s 18,688 nodes, using only 4,608 nodes. Summit still carry the flags tell the world that he keep the fast run record. Over the past decade, Linux Clusters founded and starting the competition with mainframe computer. The most famous IBM crossbar switch encounter doubt…
-
CVE-2019-10099 Apache Spark Unencrypted Data Vulnerability Aug 2019
Background: Apache Spark is the tailor made for big data industry.Spark’s advanced acyclic processing engine can operating as a stand-alone mode or a cloud service. Synopsis: Spark supports encrypting temporary data written to local disks. This covers shuffle files, shuffle spills and data blocks stored on disk (for both caching and broadcast variables). It does…
-
CVE-2019-14544 Gogs Permission Checking vulnerability Aug 2019
Preface: If you are not yet ready to share your project on GitHub. You can host your own Private GitHub. It is Gogs. Product background: The goal of Gogs is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service. So all the design concept, program code and perhaps…
-
CVE-2019-11042 PHP flaw form a way to read past the allocated buffer. This may lead to information disclosure or crash. Aug 2019
Preface: We knew Python programming language has large footprint in IoT world. Have you heard PHPoC (PHP on Chip) – a programming language and an IoT hardware platform? So, PHP programming language still have survival space. Background: The EXIF headers tend to be present in JPEG/TIFF images generated by digital cameras. In order to read…
-
How smart of the smartcity, depends on your vulnerability management (CVE-2019-14462 & CVE-2019-14463) Aug 2019
Preface: Why should we driven Artificial Intelligence like a maniac? We are mankind! MODBUS techincal background: Modbus is a communication protocol developed by Modicon systems. In simple terms, it is a method used for transmitting information over serial lines between electronic devices. The device requesting the information is called the Modbus Master and the devices…
-
Australian Cyber Security Centre urge his citizen beware of Password Spraying Attacks
Preface: Even though you company install full set of cyber defense mechanism. More than 70% of feature is detective and preventive. Perhaps SIEM can do a predictive action. May be you have doubt, but it is factual. Details: Australian Cyber Security Centre urge his citizen beware of Password Spraying Attacks (refer below url): https://www.cyber.gov.au/sites/default/files/2019-08/2019-130_-_password_spray_attacks_detection_and_mitigation_strategies.pdfSuch activities…
-
CVE-2019-1125 Status update 6th Aug 2019
Preface: GS register is used to differentiate between usermode and kernel mode range of address, after adding the relevant logical address component. The instruction swapgs is used to swap the GS register with the MSR values, and only in privileged mode this can be done. Vulnerability details: CVE-2019-1125 was made public today or also referred…
-
Das U-Boot Self-Referential DOS Partition Table Infinite Recursion Vulnerability Aug 2019
Vulnerability details: A crafted self-referential DOS partition table will cause all Das U-Boot versions through 2019.07-rc4 to infinitely recurse, causing the stack to grow infinitely and eventually either crash or overwrite other data. Introduction: Das U-Boot a popular primary bootloader, it widely used in embedded devices to fetch data from different sources and run the…