Cyber security technical information

Author: admin

  • Cisco NX-OS Software Image Signature Verification Vulnerability – Last Updated 15th Apr 2019

    Preface: This advisory is part of the March 2019 Cisco FXOS and NX-OS Software Security Advisory Bundled Publication, which includes 25 Cisco Security Advisories that describe 26 vulnerabilities. Synopsis: A digital signature (not digital certificate) is a mathematical technique used to validate the authenticity and integrity of a message, software or digital document. Vulnerability details:…

  • Apache Releases Security Updates for Apache Tomcat Original release – Last revised: April 15, 2019

    Preface: public class CGIServlet – extends javax.servlet.http.HttpServlet(CGI-invoking servlet for web applications, used to execute scripts which comply to the Common Gateway Interface (CGI) specification.) Synopsis: Tomcat implements several Java EE specifications including Java Servlet, JavaServer Pages (JSP), Java EL, and WebSocket, and provides a “pure Java” HTTP web server environment in which Java code can…

  • Do you have any concerns on multiple vulnerabilities in WPA3 Protocol? (Arp 2019)

    Preface: WPA3 protocol aim to enhance Wi-Fi security protection. Yes, it does. But something wrong with him this time. Technology Synopsis: The very damaging DoS attack consists of clogging one peer with bogus requests with forged source IP addresses. Due to computationally intensive nature of modular exponentiation, the DH key exchange is highly vulnerable to…

  • VMware Releases Security Updates Published Friday, April 12, 2019

    Preface: A quick walk through on your VMware setup, see whether 3D acceleration feature is enabled. It is recommended to disabling the 3D-acceleration feature to protect your IT environment. Vulnerability Details: CVE-2019-5514 – Vulnerability due to certain unauthenticated APIs accessible through a web socket CVE-2019-5515 – Out-of-bounds write vulnerability in the e1000 and e1000e virtual…

  • Who is cookie? Is it cookie monster? Multiple VPN applications insecurely store session cookies – 11th Apr 2019

    Preface: Who is cookie? Is it cookie monster? Multiple VPN applications insecurely store session cookies – 11th Apr 2019 Technical background: An HTTP cookie (web cookie, browser cookie) is a small piece of data that a server sends to the user’s web browser. The browser may store it and send it back with the next…

  • Hardcoded credentials concerns – MyCar mobile apps (8th Apr 2019)

    Preface: MyCar add smartphone-controlled geolocation, remote start/stop and lock/unlock capabilities to a vehicle with a compatible remote start unit. Vulnerability details: MyCar Controls mobile applications prior to v3.4.24 on iOS and prior to v4.1.2 on Android contains hard-coded admin credentials. For specifics details, please refer to diagram. Reference:https://kb.cert.org/vuls/id/174715/

  • Samba Releases Security Updates (CVE-2019-3880 & CVE-2019-3870) – Apr 2019

    Preface: Samba is an open-source software suite that runs on Unix/Linux based platforms. The design based on SMB network protocol. Samba is able to communicate with Windows clients like a native application. Synopsis: Windows OS and Linux opensource looks contains their market. A trend shown that Linux base OS well develop in automation industry. Perhaps…

  • Siemens – CVE-2019-6569 (Do not contempt this vulnerability)

    Preface: Industrial Ethernet has been the network of choice in factory auto-mation for many years and offers a powerful communication basis with PROFINET-based solutions. Vulnerability details: A vulnerability has been identified in Scalance X-200 (All versions), Scalance X-300 (All versions), Scalance XP/XC/XF-200 (All versions <V4.1). The monitor barrier of the affected products insufficiently blocks data…

  • CVE-2019-1002101: kubectl fix potential directory traversal (4th Apr 2019)

    Preface: The vulnerability if not require attacker conduct scam to persuade a user. It is a extreme dangerous vulnerability. Technical background of Kubernetes: Kubernetes (often referred to as K8s) is an open source system for automatically deploying, extending, and managing containerized applications. The system was designed by Google and donated to the Cloud Native Computing…

  • Apache Releases Security Update for Apache HTTP Server – 4th April 2019

    Alert: The Apache Software Foundation has released Apache HTTP Server version 2.4.39 to address multiple vulnerabilities. mod_auth_digest access control bypass (CVE-2019-0217) mod_ssl access control bypass (CVE-2019-0215) mod_http2, possible crash on late upgrade (CVE-2019-0197) CVE-2019-0211 bring to my attention. For the synopsis of this matter, please refer to attached diagram. Remedy: The Apache Software Foundation has…