Preface: Vendor operate in high visibility, initiate fix vulnerabilities means they are more secure than other products. Synopsis: From hardware appliance to software base. From Layer 3 to Layer 7, the growth of operations expanded, it is hard to avoid vulnerability occurs. Vulnerability Details: Cisco IOS and IOS XE Software Network-Based Application Recognition Denial of…

Preface: The statistic by Netcraft in January 2019, Apache server coverage market reach 30.88%. Technical background: Apache server not only contain web server service, it can config as a reserve proxy server to enhance the web infrastructure isolation level. Single sign-on authentication method growth significant in past few years. A popular web architecture model, setup…

Preface: In order to avoid cyber attack and insider threat. The monitoring feature is a critical feature in IT world. Background: CapMon monitors and collects information from the infrastructure and applications. The system does not require installation of extra software on other units in the network. CapMon IT monitoring has a Web based user interface,…

Preface: RSA Authentication Manager delivers intelligent, transparent, behind-the-scenes authentication to enhance every secure access scenario. Product advantage: Take full advantage of virtualization in your organization to ease deployment, administration, and on-going system management. Vulnerability details: RSA Authentication Manager versions prior to 8.4 P1 contain an Insecure Credential Management Vulnerability. A malicious Operations Console administrator may…

Preface: Cisco has announcement yesterday that there are vulnerabilities found on IP Phone 8800 Series. About IP Phone 8800 Series: The Cisco IP Phone 8800 Series delivers HD video and VoIP communications, and integrates with your mobile device to meet your business needs. Vulnerability details are shown as below: Cisco IP Phone 8800 Series Path…

Preface: To speed up the deployment of your cloud computing readiness. Use the image deployment is faster than mounting an ISO and manually installing a VM.When system admin created images for an OpenStack provider, he will pre-installed cloud-init and haveged. Azure has similar feature, it is so called Azure WaLinuxAgent. Vulnerability detail: An information disclosure…

Preface: Space Layout Randomization (ASLR) to defend against memory corruption attacks. However, Intel Software Guard Extension (SGX), it is capability protects selected code and data from disclosure or modification. From security point of view, it provides an advance protection than before. Vulnerability detail: Double free in Intel(R) SGX SDK for Linux before version 2.2 and…

Preface: VMware Horizon Client for Android and iPhone makes it easy to work on your VMware Horizon virtual desktop and hosted applications from your smartphone. About security advisory annoucement by VMware: The VMware Horizon Connection Server contains an information disclosure vulnerability. Successful exploitation of this issue may allow disclosure of internal domain names, the Connection…

Preface: With the exif extension you are able to work with image meta data. PHP capable to update the date in the exif photo headers by script. The headers includes the following: Time taken,Time modified,The camera make,The camera model,.. Design objective of exif_process_IFD_in_TIFF: Parse the TIFF header. Vulnerability Found: When execute test script, Memcheck by…

Preface: The CSP-C’s basic function is to discover the network elements and collect information from those elements.Basically the design goal is to enhance the overall detective and preventive control in the IT infrastructure. Technical highlight: To perform the Network Discovery and Data Collection operations the CSP-C needs the following credentials: SNMP Read Only community,Telnet or…