Preface: Webroot delivers next-generation endpoint security and threat intelligence services to protect businesses and individuals in a connected world. Technical background: The Webroot BrightCloud® Mobile Security SDK addresses mobile device vulnerabilities by enabling mobile management partners to offer enhanced security . Vulnerability found on 17th Dec 2018:CUJO Smart Firewall (ver 7003) provides services to avoid…

Preface: Vulnerabilities are flaws in computer software that create weaknesses in your computer or network overall security.Can you imagine that what is the actual situation before vulnerability found? Background information: Jenkins is the leading open-source automation server. Built with Java, it provides over 1000 plugins to support automation. Vulnerability announcement on 17th Dec 2018:The vulnerability…

Preface: Xen Project is a hypervisor using a microkernel design, providing services that allow multiple computer operating systems to execute on the same computer hardware concurrently. Vulnerability description:The vulnerability is due to an interpretation conflict for union data structure associated with shadow paging.The XSA-240 introduced a new field into the control structureassociated with each page…

Preface: As time goes by, an evolution in technology offers best-of-class in rendering for both VFX and feature film animation. What does VFX stand for?Visual effects (abbreviated VFX) is the process by which imagery is created or manipulated outside the context of a live action shot in film making. RenderMan offers a combination of unbiased…

Preface: Since we launched it in 2014, Kubernetes running strong. It is becoming “the Linux of the cloud,” according to Jim Zemlin, Executive Director of the Linux Foundation. Analysts estimate that 54 percent of Fortune 100 companies use Kubernetes across a spectrum of industries including finance, manufacturing, media, and others. Giant will sick as normal…

Preface: Remote code execute and Privileges escalation are the critical vulnerabilities topics which lure end user attentions. On patch Tuesday (remedy program) issued by Microsoft this week. Their product design limitation contains priviliges escalation vulnerability. CVE-2018-8611 – Vulnerability details:With reference of CVE-2018-8611 inform customer that exploit this vulnerability, an attacker would first have to log…

Background: On 28th Nov 2018, a SQL injection vulnerability found on Cisco Prime License Manager. Vendor (Cisco) with immediate action release the patch to remediate this design weakness. Technical issue found on patch: Update (2018-December-10): Installing the ciscocm.CSCvk30822_v1.0.k3.cop.sgn patch may cause functional issues. Workarounds are available for some of these issues. Rolling back this patch…

Preface: Intel Software Guard Extensions (SGX) is a set of central processing unit instruction codes from Intel that allows user-level code to allocate private regions of memory, called enclaves, that are protected from processes running at higher privilege levels. SGX design limitation:L1 Terminal Fault aka Foreshadow found in August 2018. Foreshadow enables an attacker to…

Preface: One of the biggest successes of the iPhone is its security. Still No Major Malware found on iPhone. Current possible infection methods: 1. iOS process named “iBoot” that starts up the system when you first turn on your iPhone and ensures the code being run is valid and originates from Apple. Hacker mimic counterfeit…