Preface: Microsoft has been a mainstay of the computer systems world for more than four decades. At the same time, it also promotes the development of the Internet and other technologies. About fifteen years ago, virtual machines led the way, bringing the concept into the business world and successfully fending off mainstream cybersecurity attacks. It seems that the computer system has quietly transformed into a virtual world. Maybe you will say because of cloud technology. The collaboration between network technology and cloud computing creates another potential opportunity for open source network software to jump into the competition.

Background: FRRouting (FRR) is a free and open source Internet routing protocol suite for Linux and Unix platforms. It implements BGP, OSPF, RIP, IS-IS, PIM, LDP, BFD, Babel, PBR, OpenFabric and VRRP, with alpha support for EIGRP and NHRP.

The FRR suite consists of various protocol-specific daemons and a protocol-independent daemon called zebra. Each of the protocol-specific daemons are responsible for running the relevant protocol and building the routing table based on the information exchanged.

Remark: zebra is an IP routing manager. It provides kernel routing table updates, interface lookups, and redistribution of routes between different routing protocols.

Vulnerability details: An issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP UPDATE message without mandatory attributes, e.g., one with only an unknown transit attribute.

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2023-46753

Preface: You can configure the nginx ingress controller in various ways. To use the Openstack load balancer Octavia with ssl offloading you will need to configure the ingress controller with the proxy protocol. The alternative would be to use the Openstack service barbican to store your ssl certificate. Which is currently not directly supported by Kubernetes.

Background: The Ingress exposes HTTP and HTTPS routes from outside the cluster to services within the cluster. Traffic routing is controlled by rules defined on the Ingress resource. An Ingress may be configured to give Services externally-reachable URLs, load balance traffic, terminate SSL / TLS, and offer name-based virtual hosting.

Vulnerability details: A security issue was identified in ingress-nginx where the nginx[.]ingress[.]Kubernetes[.]io/permanent-redirect annotation on an Ingress object (in the networking[.]k8s[.]io or extensions API group) can be used to inject arbitrary commands, and obtain the credentials of the ingress-nginx controller. In the default configuration, that credential has access to all secrets in the cluster.

Affected Versions : <v1.9.0

Versions allowing mitigation: v1.9.0

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2023-5044

Preface: VMware Aria Operations™ for Logs (formerly VMware vRealize® Log Insight™) analyzes complex log management through dashboards to provide shortest path to identify the problem.

Background: What is aria operations for logs? Centralized Log Management VMware Aria Operations for Logs. Manage data at scale with centralized log management, deep operational visibility, and intelligent analytics for troubleshooting and auditing across environments. Protocol that the agent uses to send log events to the Aria Operations for Logs server. The possible values are cfapi and syslog. The default is cfapi. Ingestion API (CFAPI) The ingestion API provides several advantages over the syslog protocol including the ability to collect statistical and operational information about the agents directly in the server UI and also allows for server-side configurations to be pushed to agents. vRealize Log Insight uses Apache Thrift for node-to-node communication.

Vulnerability details: VMware Aria Operations for Logs contains an authentication bypass vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.

Additional: The code execution via triggering a RemotePakDownloadCommand command via the exposed thrift service after obtaining the node token by calling a GetConfigRequest thrift command. After the download, it will trigger a PakUpgradeCommand for processing the specially crafted PAK archive, which then will place the JSP payload under a certain API endpoint (pre-authenticated) location upon extraction for gaining remote code execution.

Official announcement: Please refer to the link for details –https://nvd.nist.gov/vuln/detail/CVE-2023-34051

Preface: On October 10, 2023, Citrix released a security advisory regarding a sensitive information disclosure vulnerability (CVE-2023-4966) affecting NetScaler ADC and NetScaler Gateway appliances.

Background: Citrix NetScaler improves performance by using HTTP compression and data caching. The workload is shared over multiple servers and networks to ensure that there is not one point of failure or that one server is not overloaded, causing a slow or inefficient performance.

The Citrix ADC (formerly NetScaler) appliance instantiates the number of PEs based on the number of vCPUs, memory, and licenses.

The packet engine is created to perform TCP/IP processing, optimization tasks and acceleration of packages. This is a continues process of grabbing packets, handling them accordingly and putting the packets in place again, the packet engine is designed to run an entire instance of NetScaler’s packet engine on each processor core (nCore technology) and runs as a kernel component on the NetScaler.

Vulnerability details: Sensitive information disclosure in NetScaler ADC and NetScaler Gateway when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server. 

Official announcement: Please refer to the link for details –

https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967

Preface: When Oracle releases a security advisory. These vulnerabilities may have occurred months ago, or may be further back. But the technical details published in the CVE are only limited. So, that’s one of the reasons I’m interested in digging into the details.

In the spirit of science, everyone dares to assume but careful to verify.

Background: A WebLogic Server 10.3.6, 12.1.3, and 12.2.1.x client can invoke RMI-based applications hosted on a WebLogic Server 14c (14.1.1.0.0) server using IIOP, T3, T3S, HTTP, and HTTPS. JMS applications can be invoked using T3, T3S, HTTP, and HTTPS.

A WebLogic Server 14c (14.1.1.0.0) client can invoke RMI-based applications hosted on

A WebLogic Server 10.3.6, 12.1.3, and 12.2.1.x server using IIOP, T3, T3S, HTTP, and HTTPS. JMS applications can be invoked using T3, T3S, HTTP, and HTTPS.

For WebLogic Server 14c (14.1.1.0.0) instances running on JDK11, IIOP interoperability with Java clients is only available with a WebLogic Server 14c (14.1.1.0.0) install client running on JDK 11.

Vulnerability details: Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.4.0 and 14.1.1.0.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. Successful attacks of this vulnerability can result in takeover of Oracle WebLogic Server.

Remark: The vendor did not disclose details. Could this vulnerability occur under this circumstances? Please refer to attached diagram.

Official announcement: Please refer to the link for details –

https://nvd.nist.gov/vuln/detail/CVE-2023-22089

Preface: If you still remember more than ten years ago, a snowhttp attack target web server especially Apache web server. Slow HTTP attacks are denial-of-service (DoS) attacks in which the attacker sends HTTP requests piece by piece at a slow pace to a web server. If an HTTP request is not complete, or if the transfer rate is very low, the server keeps its resources busy waiting for the rest of the data.

Background: HTTP 2.0 uses a binary, length-prefixed framing layer, which offers more compact representation than the newline-delimited plaintext HTTP 1.x protocol and is both easier and more efficient to process.

HTTP/2 makes web pages load faster and more efficiently by simplifying communication between the browser and the server. Accessing a website using the HTTP/2 protocol is as follows: the browser requests a TCP connection. The server establishes a TCP connection. The browser requests the website’s index HTML file.

Vulnerability details: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

Additional: Because of CVE-2023-44487, HTTP/2 enabled web servers are vulnerable to a DDoS attack. It so called “Rapid Reset Attack”.

The HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally.

The ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. As a result, the server keeps its resources in heavy load status.

Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2023-44487

Preface: Infrastructure as code (IaC) is the process of dynamically managing and provisioning infrastructure through code instead of through a manual process to simplify app development, configuration, and runtime. IaC uses DevOps methodology and versioning with a descriptive model to define and deploy infrastructure. For example: Cloud comupting platform structure components includes networks, virtual machines, load balancers, and connection topologies.

Infrastructure as code (IaC) uses DevOps methodology and versioning with a descriptive model to define and deploy infrastructure. For example: Cloud comupting platform structure components includes networks, virtual machines, load balancers, and connection topologies.

Remark: A general example of descriptive modeling is business reporting in the form of graphs, charts, and dashboards.

Background: Ansible is an tool for simple automation tasks. Python tool provides more flexibility and control over automation and is an excellent tool for complex automation tasks. Based on Python and Django, it can develop an automated task execution and asset management (CMDB) system with DevOps concept.

Ansible architecture is client-server architecture model. It has three main components: control nodes, managed nodes and communication channels.

Ansible automates Linux and Windows by connecting to managed nodes and pushing out small programs called Ansible modules. Ansible executes these modules, which are the resource models of the desired system state, over Secure Socket Shell (SSH) by default and removes them when finished.

Vulnerability details:

CVE-2023-5115 – ansible-core: malicious role archive can cause ansible-galaxy to overwrite arbitrary files

CVE-2023-41164 – automation-controller: Django: Potential denial of service vulnerability in  django.utils.encoding.uri_to_iri()

Official announcement: Please refer to the link for details –

https://access.redhat.com/errata/RHSA-2023:5701

Security Focus: CVE-2020-36558 appears in this patch. Do you have interest to know the details?

Preface: A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.

Background: RHEL 8.6 includes a wide range of new features and enhancements . Primary features and benefits:

i.Mitigate potential risks across the hybrid cloud – Web console support for Smart Card Authentication with Sudo and SSH to use smart card authentication credentials when performing administrative functions and accessing remote hosts through the RHEL web console.

ii.Support for SAP HANA in production with Red Hat and SAP, a jointly-tested RHEL configuration with SELinux enabled. SELinux’s security technology allows process isolation, offering great privilege escalation attack mitigation to SAP users.

Vulnerability details: CVE-2020-36558 – kernel: race condition in VT_RESIZEX ioctl when vc_cons[i].d is already NULL leading to NULL pointer dereference

Synopsis: The reason for this vulnerability is that the statement “if” judgment is bypassed through conditional competition, so that after obtaining the lock, vc_cons[i].d is still NULL, which means that vc_cons[i].d has a value at the beginning. When the statement “if” After the judgment is made, or before the lock is obtained, set vc_cons[i].d to NULL through another thread. Then, statement “if” you can allocate page 0, you can carefully construct the data and realize reading and writing at any address.

Due to design limitation, before linux 2.6.31, it is possible to allocate 0 pages of memory. Combined with specify vulnerability in 2019, attacker be able to bypass the 0 page allocation limit. So, CVE-2020-36558 should be exploitable.

Ref: The ‘if’ Statement: The basic syntax of the if statement looks like this: if (condition) { // code to be executed if the condition is true; }.

Official announcement: Please refer to the link for details – https://access.redhat.com/errata/RHSA-2023:5627

Preface: Xen is an open-source hypervisor that allows the simultaneous development, execution, and management of multiple virtual machines on one physical computer. Xen offers two types of virtualization: paravirtualization and full virtualization.

Background: The Xen Project hypervisor is an open-source type-1 or bare-metal hypervisor. It allows many instances of an operating system or different operating systems to run in parallel on a single machine (or host). Xen hypervisor is used as the basis for many different commercial and open-source applications, such as: server virtualization, Infrastructure as a Service (IaaS), desktop virtualization, security applications, embedded, and hardware appliances.

Citrix Hypervisor is based on the Xen Project hypervisor, with extra features and supports provided by Citrix. Citrix Hypervisor 8.2 uses version 4.13.4 of the Xen hypervisor.

Vulnerability details: Closing of an event channel in the Linux kernel can result in a deadlock. This happens when the close is being performed in parallel to an unrelated Xen console action and the handling of a Xen console interrupt in an unprivileged guest.

Official announcement: Please refer to the link for details –

https://support.citrix.com/article/CTX575089/citrix-hypervisor-multiple-security-updates

Preface: The Resource Reservation Protocol (RSVP) is a transport layer protocol designed to reserve resources across a network using the integrated services model.

Background: The Resource Reservation Protocol (RSVP) is a transport layer protocol designed to reserve resources across a network using the integrated services model. RSVP operates over an IPv4 or IPv6 and provides receiver-initiated setup of resource reservations for multicast or unicast data flows.

The multicasting prevents unwanted message transmission and avoids clogging of the network.

Vulnerability details: A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the `rsvp_classify` function. This issue may allow a local user to crash the system and cause a denial of service.

Ref: The total number of bytes in the packet is ‘len’. SKBs are composed of a linear data buffer, and optionally a set of 1 or more page buffers. If there are page buffers, the total number of bytes in the page buffer area is ‘data_len’. Therefore the number of bytes in the linear buffer is ‘skb->len – skb->data_len’.

Official announcement: Please refer to the link for details –

https://nvd.nist.gov/vuln/detail/CVE-2023-42755