-
14th Aug 2018 – Intel side-channel L1TF vulnerability
An official announcement state that there are three more data-leakage security holes found in Intel chips: CVE-2018-3615 – L1 Terminal Fault: SGX CVE-2018-3620 – L1 Terminal Fault: OS/SMM CVE-2018-3646 – L1 Terminal Fault: VMM Across the board, Intel’s desktop, workstation, and server CPUs are vulnerable. Official announcement shown as below: https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00161.html Reminder: I am using window…
-
The accomplice – The accomplice – Oracle design limitation let compromise JVM do the privileges escalation in Oracle DB (CVE-2018-3110)
When I was young, the comics story attracting my seen. The comics picture similar provides like a virtual speaker tell a story to me. Oracle has released a security alert to address a vulnerability in multiple versions of Oracle Database yesterday. A remote attacker could exploit this vulnerability to take control of an affected system.…
-
About vulnerabilities of PHP – Aug 2018
PHP is a popular open source general-purpose scripting language. It capable for web development and can be embedded into HTML. Perhaps a fundamental weakness of PHP and therefore we seen common problem especially SQL Injection and Trusting user input to execute code happens in frequent. Below details are the php vulnerabilities found on Aug 2018.…
-
KEYCLOAK design weakness – Aug 2018
Security Assertion Markup Language (SAML) is an open standard for exchanging authentication and authorization data between parties. If you ask me, what is the design objective of SAML. It make your life simple.Also this is the aim for computer system. But a pin does not have two points. For those who use single sign on…
-
Aug 2018 – Malware (KEYMARBLE)
My friend informed that a new malware wreak havoc. Meanwhile US-Cert issued the technical articles described the details and let’s the world staying alert! US-CERT also provides the Indicator of compromise (IOC) file for reference. I am interested and therefore I put the this file into the sandbox see whether what exact issue will be…
-
8th Aug 2018 – ISC Releases Security Advisory for BIND
If you are easy nervous, seems IT job not suitable for you! The Domain Name System (DNS) is the backbone of the modern internet. The workstation similar a blind people searching the correct pathway in the dark. ISC releases security advisory for BIND yesterday. My roughly statistic shown to me that this is the third…
-
Digital Defense – about social communication media or email communications
-
Aug 2018 – Less than one month, VMware out-of-bounds read vulnerability happen again!
VMware announce that a bug found on their Horizon Connection Server, Horizon Agent, and Horizon Clien. However Horizon Agents on Linux-based systems and Horizon Clients on non-Windows systems are not affected. The symptom is that out-of-Bounds Memory Read Error in Message Framework Lets Local Users View Portions of System Memory on the Target System. From…
-
Insufficient Input Validation – Intel Distribution for Python (IDP) – Jul 2018
Mozilla’s bleach library is a security-related library. The design goals of Bleach is to sanitize input of malicious content. Furthermore it let software developer safely create links. IPython is a command shell for interactive computing in multiple programming languages, originally developed for the Python programming language, that offers introspection, rich media, shell syntax, tab completion,…
-
Aug 2018 – Do not contempt this vulnerability (CVE-2018-5390)
The hardware vendors deploy Linux OS on demand growth. Even though your firewall appliances, malware detector, load balancer, network L2 and L3 switch and IoT devices are the Linux. The attacker found a tricks recently. If source device feeds tiny packets completely out of order. The parameter (tcp_collapse_ofo_queue()) might scan the whole rb-tree. As a…