Computerized Numerical Control (CNC) Machining is a method used to perform a wide range of manufacturing tasks, which are all carried out by computerized devices. … The new CNC machines were able to be controlled by programming language to carry out a wider variety of tasks with greater accuracy. Delta, a world-class provider of industrial automation solutions includes CNC.

Found Delta CNCSoft Version 1.00.83 and prior with ScreenEditor Version 1.00.54 has two out-of-bounds read vulnerabilities and multiple stack-based buffer overflow problem. To my observation, CNCSoft application looks embedded with a password. May be there is another root cause.

Official recommendation:

Update to the latest version of CNCSoft, v1.01.09. The updated version can be found at: http://www.deltaww.com/Products/PluginWebUserControl/downloadCenterCounter.aspx?DID=84&DocPath=1&hl=en-US

Adobe has released updates for Photoshop CC for Windows and macOS. An attacker could exploit these vulnerabilities to take control of an affected system. See whether the picture can tell the story?

Official announcement shown as below (url):

https://helpx.adobe.com/security/products/photoshop/apsb18-28.html

The product name Ghostscript misleading people that it is a undergound hack tool. Actually Ghostscript is a suite of software based on an interpreter for Adobe Systems’ PostScript and Portable Document Format page description languages. And therefore it might install in your computer already. On Oct 2016, Google security expert infomed that we must stay alert for vulnerability found in ghostscript (multiple ghostscript -dSAFER sandbox problems).It looks this issue become serious. US-CERT prompt the alert again! Should you have interest, please refer below:

https://www.kb.cert.org/vuls/id/332928

The software expert keen to reduce memory footprint and improve their application performance.Java code can run on different systems, because it relies on the JVM, not on the operational system itself. This is the powerful function of Java plus JVM. Meanwhile, it let’s Java application developers and end users spreading around in the world. The virtual machine creates an independent platform on top of the operating system. Similar the situation of Docker in today’s cloud computing.The JVM is a “simulated machine” that can be installed on different systems.  Furthermore, if vulnerability occurs in JVM. It will jeopardizing the related system facilities since the application run on top of JVM.

CVE-2018-12539 – In Eclipse OpenJ9 version 0.8, users other than the process owner may be able to use Java Attach API to connect to an Eclipse OpenJ9 or IBM JVM on the same machine and use Attach API operations, which includes the ability to execute untrusted native code.

Remediation – Attach API is enabled by default on Windows, Linux and AIX JVMs and can be disabled using the command line option –Dcom.ibm.tools.attach.enable=no.

ABout the details CVE-2018-12539 : https://bugs.eclipse.org/bugs/show_bug.cgi?id=534589

Additional CVE-2018-12537: https://bugs.eclipse.org/bugs/show_bug.cgi?id=536038

A regular expression (regex or regexp for short) is a special text string for describing a search pattern. We can’t lack of this function in IT world. For example, your SIEM log parser and Web server input protection filter.

Eventhough if you want to represent a group of Strings according to a particular pattern then you should go for Regular Expression. Just heard that the regular expression function can be modify by attacker.Then conduct denial of service attack.

I download node.js package do the proof of concept. It looks that it is ture. For more details, please reference to attached diagram. Java is also known to be affected by ReDoS attacks.

Technical articles shown as below:

http://people.cs.vt.edu/dongyoon/papers/EUROSEC-17-EHP.pdf

Sometimes the situation of the technology world similar a people stand in the cross road. For instance, you relies on remote access to do your work. We relies SSL/TLS so far. Now we know SSL TLS 1.0 not safe and advice to use TLS 1.1 and 1.2. VPN (virtual private network) like a mandatory interconnect of our life daily. We known already that VPN with IKEv1 aggressive mode not safe. How about IKEv1 main mode situation? The world tell the truth this week. IKEv1 Main Mode vulnerable to brute force attacks. The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. (CVE-2018-5389). The fact is that an attacker may be able to recover a weak Pre-Shared Key (weak shared secret).

Offical details shown below reference hyperlink.

https://www.kb.cert.org/vuls/id/857035

Apache and Tomcat is a perfect match. Their relationship similar pianist and piano. We can’t lack of music in our life. On the other hand, IT world can’t without Apache and Tomcat. But Tomcat is sick today. Found the Apache Tomcat Native (1.2.0 to 1.2.16 and 1.1.23 to 1.1.34) has a flaw that does not properly check OCSP pre-produced responses, which are lists (multiple entries) of certificate statuses. As a result, revoked client certificates may not be properly identified. It allow suspects to authenticate with revoked certificates to connections that require mutual TLS. Native connector use OpenSSL for SSL/TLS function. Refer to attached diagram. If such vulnerability occurs, in the sense that the suspects can control the whole system. It is hard to imagine that how worst will be the IT shop using multiple vhost setup (see below specifications)!

Tomcat 8 supports
one TLS virtual host per connector
one certificate per virtual host

Tomcat 9 supports
multiple virtual hosts per connector (SNI)
multiple certificates per virtual host

For more details, please reference to official announcement.

http://tomcat.apache.org/security-native.html#Not_a_vulnerability_in_the_Apache_Tomcat_APR/native_Connector

Android and iOS apps contain multiple vulnerabilities:

Original Release date: 14 Aug 2018 | Last revised: 15 Aug 2018

Google apps store and App Store (iphone) enforce security policies last year get rid the suspected malicious apps in their store. From customer point of view, it looks better because this is the soure download location. It will avoid the malware infection. A efficency way to avoid cyber security accident and data breach in mobile devices world. However there is another way to evade your phone security setting. What is the way? The OEM vendor pre installed apps like a backdoor. Let’s the Android and iOS apps embed a hard-coded cryptographic key bypass the original security settings.

US-CERT security alert – please refer below url:

https://www.kb.cert.org/vuls/id/787952

Vulnerability Note VU#641765 – 14 Aug 2018

Linux kernel IP fragment re-assembly vulnerable to denial of service

Cyber security guy includes myself really tired last few days. Found Linux kernel IP fragment re-assembly vulnerability today. It causes denial of service. It looks that computer appliances vendor not confirm this vulnerability on their product yet.
If you are really concern. Please review below parameters. You can do it manually to remediate this issue. If it works, please thank you to ultraman.

echo 393216 > /proc/sys/net/ipv4/ipfrag_low_thresh
echo 544288 > /proc/sys/net/ipv4/ipfrag_high_thresh

sysctl -w net.ipv4.ipfrag_low_thresh=393216
sysctl -w net.ipv4.ipfrag_high_thresh=544288

CERT technical articles for reference – https://www.kb.cert.org/vuls/id/641765