Cyber security technical information

Author: admin

  • CISA Releases Blog on Emergency Directive: January 24, 2019

    Preface: Cyber security experts predict that global DNS hijacking activities are underway. However, it is not certain who is the attacker (the cyber attack group), FireEye said on January 9, 2019. Background information: This cybersecurity incident caught the attention of the Network Security and Infrastructure Security Agency (CISA). Whereby, CISA released their first emergency order…

  • CVE-2019-1651 – Cisco SD-WAN Solution Buffer Overflow Vulnerability (23rd Jan 2019)

    Preface: Cisco SD-WAN key advantage keen to reducing costs with transport independence across MPLS, 3G/4G LTE, etc. Meanwhile it improving business application performance and increasing agility. Technical background: The vSmart controller is the brains of the centralized control plane for the Viptela system network architecture. The vSmart controller runs as a virtual machine (VM) on…

  • TIBCO Security Advisory: January 16, 2019

    Preface: Tycoon wants to invest in a football team. He wants to know which is the good team, how many matches they won in years, the revenue they generate,..etc. Believe that analyzing data solution (TIBCO Spotfire ) can help. TIBCO Spotfire technology Synopsis: Data virtualization time-to-solution is 5‒10X faster than traditional data warehousing and ETL.You…

  • 22nd Jan 2019 – Apple security updates

    Preface: Every computer has a finite amount of memory so OS might actually need to use more than is physically available on your system. As a result, it is hard to avoid sharing resources feature. Our security focus: In regard to security update announced by Apple. Our security focus of this topic will be follow…

  • Who can you trust in the Internet world? Security Issues with LOAD DATA LOCAL in MySQL DB.

    Preface: Some organizations that use MySQL include GitHub, US Navy, NASA, Tesla, Netflix, WeChat, Facebook, Zendesk, Twitter, Zappos, YouTube,…etc Background: Technology writer Ionut Ilascu alert that there is command in MySQL server could be use for steal the personal and web server data without a high level evasion technique. Technical overview: Security Issues with LOAD…

  • Is this a careless mistake? BlackRock Exposes Confidential Data on Thousands of Advisers on iShares Site!

    Preface: Excel spreadsheets are used all the time in high-risk financial data analysis, and sometimes this is a silent way to dig out the data. BlackRock data leakage synopsis: Bloomberg found three spreadsheets contains BlackRock’s iShares ETF business confidential information included thousands of financial advisors were given ratings based on how much business they bring…

  • CVE-2019-6446 NumPy pickle Python Module Remote Code Execution Vulnerability – 16th Jan 2019

    Preface: Gamma-Ray Observatory Satellite Mission for the study of cosmic gamma-ray sources in the keV to MeV energy range. About Numpy and Gammapy: NumPy is an open source Python package for scientific computing. NumPy supports large, multidimensional arrays and matrices. NumPy is written in Python and C. NumPy arrays are faster compared to Python lists.…

  • CoreOS etcd Role-Based Access Control Authentication Vulnerability – 16th Jan 2019

    Preface: Container Linux by CoreOS is an open-source lightweight operating system based on the Linux kernel and designed for providing infrastructure to clustered deployments, while focusing on automation, ease of application deployment, security, reliability and scalability. Found vulnerability: A vulnerability in CoreOS etcd could allow an unauthenticated, remote attacker to bypass security restrictions and gain…

  • Drupal Releases Security Updates – 16th Jan 2019

    Preface: Drupal is a free and open source content-management framework written in PHP and distributed under the GNU General Public License. Security Focus: Drupal has traditionally depended on multiple external tools. Drupal core uses the third-party PEAR Archive_Tar library. In PEAR Archive_Tar before 1.4.4, there are several file operation with $v_header[‘filename’] as parameter (such as…

  • Security Focus – Critical Path Update contains 3 new security fixes for the Oracle Database Server – 15th Jan 2019

    Preface: Computer system vulnerability wreak havoc, IT life not easy! Background: Oracle’s revolutionary cloud database features autopilot, self-protection, and self-healing capabilities designed to eliminate error-prone manual data management. But the Core RDBMS vulnerability still exists! Security focus – CVE-2019-2444: Since it did not provide the details. We supculated that even if you revoke the CREATE…