-
weekly security focus – memory leak vulnerability in vmci module (cve-2020-3959)
Preface: TCP / IP design restrictions have introduced security vulnerabilities to transport protocols. Security focus: Memory leak vulnerability in VMCI module (CVE-2020-3959) – VMware ESXi, Workstation and Fusion contain a memory leak vulnerability in the VMCI module. It lets local non-administrative user send a malformed packet to a virtual machine. Such action may be able…
-
NSA preemptive curb threats factor – an exploitation of exim design weakness – 29th May 2020
Preface: The severity depends on your configuration, said vendor. It depends on how close to the standard configuration your Exim runtime configuration is. Jun 2019 Headline news on 28th May 2020 – The National Security Agency (NSA) has released a cybersecurity advisory on Russian advanced persistent threat (APT) group Sandworm exploiting a vulnerability—CVE-2019-10149—in Exim Mail…
-
Critical Android bug 8,8.1 and 9 (CVE-2020-0096) – 27th May 2020
Preface: As of April 2020, 37.4% of Android devices run Pie, making it the most popular Android version. Vulnerability details: A critical vulnerability on Android causes privilege-escalation The impact is that it allows attackers to hijack any app on an infected phone, it is much more difficult to detect, the name so called StrandHogg 2.0.…
-
Security focus – Bind vulnerability (CVE-2020-8616) – 20th May 2020
Preface: BIND is open source software that enables you to publish your Domain Name System (DNS) information on the Internet, and to resolve DNS queries for your users. About traditional DNS attack: An example of a DoS attack is the SYNflood, which uses a the TCP SYN packet to create half open TCP connections on…
-
VMware Cloud Director updates address Code Injection Vulnerability (CVE-2020-3956) – 22nd May 2020
Preface: Don’t underestimate the vulnerabilities discovered in the past, it will cause trouble for your cloud or system. Background: VMware vCloud Director is a management tool for private and hybrid cloud architectures. Top Industries that use VMware vCloud Director are Financial Services, Insurance Program Managers Group, & business technology services provider. Vulnerability details: VMware officially…
-
an issue was discovered in smartbear readyapi soapui pro 3.2.5 (20th May 2020)
Preface: SmartBear ReadyAPI and SoapUI are automated testing tools that you can use to create functional and security tests for web service APIs. The easiest way to run ReadyAPI tests from Azure DevOps is to use the SoapUI Pro for Azure DevOps task. Background: The ReadyAPI platform accelerates functional, security and load testing of RESTful,…
-
Remedy on CVE-2020 -11651, CVE-2020 -11652 VMware vRealize Operations Manager addresses Authentication Bypass and Directory Traversal vulnerabilities – 12th May 2020
Preface: If application do not defenses against directory traversal attacks, so an attacker can request the following URL: hxxp://xxx[.]com/loadImage?filename=../../../etc/passwd Vulnerability details: The VMware Application Remote Collector (ARC) introduced with vRealize Operations Manager 7.5 can integrate with Salt (SaltStack). However the vulnerabilities (CVE-2020-11651 and CVE-2020-11652) found in saltstack this month will be impact VMware operation simultaneously.…
-
SaltStack has released a security update to address critical vulnerabilities affecting Salt versions prior to 2019.2.4 and 3000.2 (1st May 2020)
Product background: If you have one hundred servers, so it makes sense to use Puppet(open source DevOps systems management tool)for centralizing and automating the configuration management process. SaltStack itself is an open source infrastructure centralized management platform. Compared with other commercial products, its deployment and configuration are slightly more complicated. Vulnerability details: SaltStack has released…
-
Alert users that a previously disclosed Oracle WebLogic Server remote code execution vulnerability (CVE-2020-2883) is being exploited in the wild. (3rd May 2020)
Preface: Perhaps my alert late for 3 days, but the specify vulnerability hide himself in webLogic product for few years! Vulnerability details: Alert users that a previously disclosed Oracle WebLogic Server remote code execution vulnerability (CVE-2020-2883) is being exploited in the wild. You can read the official announcement in following link – https://blogs.oracle.com/security/apply-april-2020-cpu One of…
-
VMware ESXi patches address Stored Cross-Site Scripting (XSS) vulnerability (CVE-2020-3955) – 28th Apr 2020
Preface: Perhaps when you do the web scan or web penetration test. XSS will be easy to find out. However people has contempt this matter. How to avoid XSS happen? 1. Input should filter characters especially < > & ‘ ” . 2. Whitelisting and input validation are more commonly associated with SQL injection, they…