-
Vulnerabilities in SIMATIC S7-1200 and SIMATIC S7-1500 CPU families (Aug 2019)
Preface: In 1885 Westinghouse imported a Siemens AC generator, to begin experimenting with AC networks in Pittsburgh. As of today, the business development of Siemens extend to all industry. Product background: The Siemens SIMATIC S7-1200 & S7-1500 is the controller for open-loop and closed-loop control tasks in mechanical equipment manufacture and plant construction. Its range…
-
CVE-2019-12256 The industrial, and medical devices has been affected by IPV 4 component design flaws in VxWorks 7 & VxWorks 6.9 (Aug 2019)
Background: Wind River’s VxWorks is widely used in communications, military, aerospace, industrial control and other fields for its high reliability and excellent real-time performance. For example, it is used in the US F-16, FA-18 fighters, B-2 stealth bombers and Patriot missiles. The most famous is the Mars probe that landed on the surface of Mars…
-
When CVE-2019-14809 was announced, do you think you need to adjust your e-commerce operations? Aug 2019
Background: Google Go Language is suitable for web development especially front-end development. Quite a lot of companies using GO. For instance Facebook, Twitter, YouTube, Apple, Dropbox, Docker, Soundcloud, Mozilla Firefox, The New York Times, Github, GOV.UK and UBER. Vulnerability details: A vulnerability in the net/url package in Golang Go could allow an unauthenticated, remote attacker…
-
Previous NFS 4.1 vulnerability (CVE-2018-16884) show linux kernel design weakness.
Preface: A vulnerability in the NFS41+ subsystem of the Linux Kernel could allow an authenticated, adjacent attacker execute arbitrary code on a targeted system. The vulnerability exists because the bc_svc_process() function of the affected software uses the wrong back-channel ID. use-after-free in svc_process_common The defect not only affected software uses the wrong back-channel ID. Furthermore…
-
Closer look: CVE-2019-1162 Windows ALPC Elevation of Privilege Vulnerability
Preface: ALPC (Advanced/Asynchronous Local Procedure Call) is a C/S model technology developed by Microsoft to replace LPC for native RPC. Vulnerability details: Tasks created by the Task Scheduler will create the folder and file in “c:\windows\system32\ tasks”. This function original to be designed to write the discretionary access control list of the task in this…
-
THE GREATER THE POWER OF THE COUNTRY, THE STRONGER THE SUPERCOMPUTER.
Summit, launched in 2018, delivers 8 times the computational performance of Titan’s 18,688 nodes, using only 4,608 nodes. Summit still carry the flags tell the world that he keep the fast run record. Over the past decade, Linux Clusters founded and starting the competition with mainframe computer. The most famous IBM crossbar switch encounter doubt…
-
CVE-2019-10099 Apache Spark Unencrypted Data Vulnerability Aug 2019
Background: Apache Spark is the tailor made for big data industry.Spark’s advanced acyclic processing engine can operating as a stand-alone mode or a cloud service. Synopsis: Spark supports encrypting temporary data written to local disks. This covers shuffle files, shuffle spills and data blocks stored on disk (for both caching and broadcast variables). It does…
-
CVE-2019-14544 Gogs Permission Checking vulnerability Aug 2019
Preface: If you are not yet ready to share your project on GitHub. You can host your own Private GitHub. It is Gogs. Product background: The goal of Gogs is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service. So all the design concept, program code and perhaps…
-
CVE-2019-11042 PHP flaw form a way to read past the allocated buffer. This may lead to information disclosure or crash. Aug 2019
Preface: We knew Python programming language has large footprint in IoT world. Have you heard PHPoC (PHP on Chip) – a programming language and an IoT hardware platform? So, PHP programming language still have survival space. Background: The EXIF headers tend to be present in JPEG/TIFF images generated by digital cameras. In order to read…
-
How smart of the smartcity, depends on your vulnerability management (CVE-2019-14462 & CVE-2019-14463) Aug 2019
Preface: Why should we driven Artificial Intelligence like a maniac? We are mankind! MODBUS techincal background: Modbus is a communication protocol developed by Modicon systems. In simple terms, it is a method used for transmitting information over serial lines between electronic devices. The device requesting the information is called the Modbus Master and the devices…