Preface: If you try to open an .MHT file on a computer including Windows 10, or Windows Server 2012 R2 then it will attempt to load the file using Internet Explorer eventhough of the default browser in place!

Security Focus: Microsoft released an emergency security update on Monday (February 10, 2020) to fix a vulnerability in Internet Explorer (IE) designed to alert business customers. This issue occurs because the ‘scripting engine’ fails to properly handle objects in memory. Attackers can exploit this issue by enticing an unsuspecting user of the affected application to view a specially crafted web page.

Remedy: For more details, please refer to official announcement – https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0674

Preface: Sudo (substitute user [or superuser] do) is a program used in Unix-like operating systems such as BSD, Mac OS X, and GNU / Linux to allow users to execute programs in a secure manner with special permissions (usually the system Super user).

Highlight: When pwfeedback is set, sudo will provide visual feedback when the user presses a key. This function allows the system to indicate the currently entered character with an asterisk character.

Vulnerability details: In January 2020, CVE-2019-18634 announced a vulnerability that had existed for more than 9 years, pointing out in the pwfeedback feature option. This function allows the system to indicate the currently entered character with an asterisk character. However, after the pwfeedback function is enabled in the sudoer file, it may allow users to trigger a stack buffer overflow attack, allowing users without system management rights, even those not listed in the sudoer file. Users in can be elevated to root account permissions.

Remedy: The bug is fixed in sudo 1.8.31.

Preface: Ray Tomlinson sent the first email across a network, initiating the use of the “@” sign to separate the names of the user and the user’s machine in 1971, when he sent a message from one DEC-10 computer to another DEC-10.

Synopsis: An SMTP relay is a protocol that allows email to be transmitted through the internet. OpenSMTPD design goals include security, reliability & easy of configuration. If you are OpenBSD ( open-source Unix-like operating system ) user, you can setup OpenSMTPD to relay local emails to Gmail.

Vulnerability details: So called the code blew a hole in relay server.

Privileges escalation: When mail is received by server, it uses the root (superuser account) to deal with it. And therefore anyone who’s can exploit this vulnerability. It similar to “promote” themselves to root.

This vulnerability exists in OpenBSD’s mail server OpenSMTPD’s “smtp_mailaddr()” function, and affects OpenBSD version 6.6. This allows an attacker to execute arbitrary shell commands like “sleep 66” as root user.

Remedy: To remediate this vulnerability, affected OpenBSD users are recommended to install patches for OpenBSD 6.6. See reference 019 in https://www.openbsd.org/errata66.html.

Preface: The biggest differentiator between CIAM and regular (internal) IAM is that in CIAM the consumers of the service manage their own accounts and profile data.

Background: FusionAuth provides all of the features you need without the need to code plugins or purchase an enterprise license. It also capable for SaaS architecture provides maximum flexibility when it comes to deployment. You can also choose the type of database to use and the OS to install on.

Vulnerability details: Who have privileges to modify templates, instead of system admin or root. They can exploit this feature to conduct a Remote Command Execution. Vendor has alert to the user with the following statement. BE CAREFUL! this tag, depending on use, may allow you to set something up so that users of your web application could run arbitrary code on your server. This can only happen if you allow unchecked GET/POST submissions to be used as the command string in the exec tag.

Remedy: This vulnerability has been fixed in version 1.11 of FusionAuth.

Technical Background: How to manages a CDE session? The dtsession command provides session management functionality, compliant with ICCCM 1.1, during a user session, from login to logout. It starts a window manager and allows users to save a session, restore a session, lock a session, start screen savers, and allocate colors for desktop-compatible clients.

Vulnerability details: A buffer overflow in the CheckMonitor() function in the Common Desktop. It allows local users to gain root privileges via a long palette name passed to dtsession in a malicious .Xdefaults file (CVE-2020-2696).

• All Official Ubuntu variants 12.04 – 18.04
• Debian 6, 7, 8, 9
• Fedora 17 at least
• Archlinux
• Red Hat
• Slackware 14.0
• OpenBSD
• NetBSD
• FreeBSD 9.2, 10.x, 11.x
• openSUSE Tumbleweed (gcc7)
• openSUSE Leap 4.2 (gcc4)
• SUSE 12 SP3 (gcc4)
• Solaris, OpenIndiana

Remedy: The open source CDE 2.x version have issued the following patches for this vulnerability:

https://sourceforge.net/p/cdesktopenv/mailman/message/36900154/

https://sourceforge.net/p/cdesktopenv/code/ci/6b32246d06ab16fd7897dc344db69d0957f3ae08/

Preface: A race condition allows an attacker to access a shared resource, which can lead to an attack by other participants using the resource.

Background: VMware Tools is a set of services and modules that enable several features in VMware products for better management of, and seamless user interactions with, guests operating systems.

Vulnerability details: The attacker can exploit this vulnerability because standard user entitled write permission from the directory. Apart from that this Common Agent Framework (CAF) subdirectory inherit the priviliges access control.

Remedy: To remediate this issue, it is recommended to upgrade VMware Tools to 11.0.0 or later.
However, if upgrading is not possible, exploitation of this issue can be prevented by correcting the ACLs on “C:\ProgramData\VMware\VMware CAF” directory in the Windows guests running VMware Tools 10.x.y versions. In order to correct ACLs for this directory, remove all write access permissions for Standard User from the directory.

Disable inheritance, remove all inherited permissions, grant “Full control” to local System account and Administrators group Correct the ACL from the Windows UI via Properties of the directory.

Official announcement: Please refer to URL – https://www.vmware.com/security/advisories/VMSA-2020-0002.html

Technical background: A layer 7 load-balancer takes routing decision based on IPs, TCP or UDP ports or any information it can get from the application protocol (mainly HTTP). It is a Linux operating system based of machine. HTTP and HTTPS are the predominant Layer 7 protocol for website traffic on the Internet. A path traversal attack (also known as directory traversal) aims to access files and directories that are stored outside the web root folder.

Vulnerability: An issue was discovered in Citrix Application Delivery Controller (formly Netscaler) and Gateway 10.5, 11.1, 12.0, 12.1, and 13.0. They allow Directory Traversal. If this vulnerability exploited, could allow an unauthenticated attacker to perform arbitrary code execution. The fact is that it will impact the back end, perhaps it is a web portal or web server cluster. The Cybersecurity and Infrastructure Security Agency (CISA) has released a utility to conduct a test on specific product.

For more details, please refer to url. https://github.com/cisagov/check-cve-2019-19781

Preface: kdump is a feature of the Linux kernel that creates crash dumps in the event of a kernel crash. When triggered, kdump exports a memory image (also known as vmcore) that can be analyzed for the purposes of debugging and determining the cause of a crash.

Vulnerability details: Improper handling of specific IPv6 packets sent by clients mbuf and let memory leak occurs. This memory leak eventually leads to a kernel crash (vmcore), or the device hanging and requiring a power cycle to restore service, creating a Denial of Service (DoS) condition.

Official announcement and remedy solution:https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10982&cat=SIRT_1&actp=LIST

Additional possibilities – handling IPv6 packet design weakness

a. The server side sets IPV6_RECVPKTINFO on a listening socket, and the client side just sends a message to the server. Then the kernel panic occurs on the server.

b. net.ipv6.conf.eth0.max_addresses=16 It is not recommended to set this value too large (or to zero) because it would be an easy way to crash the kernel by allowing too many addresses to be created.

Preface: REST APIs are stateless. Stateful APIs do not adhere to the REST architectural style.

Background: SOAP is a protocol, and REST is an architectural style. A REST API can actually utilize the SOAP protocol, just like it can use HTTP. The Cisco Fabric Automation REST APIs for third party applications enables you to programmatically control Cisco Fabric Automation. All the REST API operations can also be performed using the DCNM GUI as DCNM uses these REST APIs to render the GUI.

Remark: From Release 10.0(1), by default, the Cisco DCNM supports HTTPS only.

Security Focus: Cisco Data Center Network Manager Authentication Bypass Vulnerabilities

Vulnerability Details:
CVE-2019-15975 – Cisco Data Center Network Manager REST API Authentication Bypass Vulnerability
CVE-2019-15976 – Cisco Data Center Network Manager SOAP API Authentication Bypass Vulnerability

If hacker already conducted infiltration to specific workstation before DCNM install. It will make this attack scenario straight forward. Because the network traffic before reach SSL tunnel not require any man-in-the-middle technique can capture the traffic. So it is easy to capture all the details through your web browser.
The design defect retain a secret key in end point during installation, so hacker can perform arbitrary actions through the REST API with administrative privileges. Since he know the user name and password. Therefore he can create a JSON Web Token and sign it using same secret key. Should you be interested, please read the details of attached diagram.

Cisco official announcement – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20200102-dcnm-auth-bypass