Adobe has released security updates to address vulnerabilities in Adobe Acrobat and Reader. Electronic document transform to an attacking tools are worry in cyber security world so far. The fact is that it is hard to detect such indirect attack. The simple we will know it is easy to evade the defense machanism. A malicious user can pass a `cff` font file to the application to cause a heap-based buffer overflow that can lead to an out-of-bounds write. This can cause the application to crash or overwrite values in the heap. If it overwrite chunk header, corrupt free(), but program doesn’t crash. It will be very dangerous!

Don’t underestimate! Offical URL shown as below:

https://helpx.adobe.com/security/products/acrobat/apsb18-34.html

Basic Understanding:

What is smart card? A smart card is a security token that has an embedded chip. Smart cards are typically the same size as a driver’s license and can be made out of metal or plastic

Basicaly you can get smart card in two states: either blank or initialized. For blank cards OpenSC has code to initialize the card in PKCS#15 format.

PKCS#11 – The PKCS#11 interface is used to communicate or access the cryptographic devices such as HSM (Hardware Security Modules) and smart cards. The primary purpose of HSM devices is to generate cryptographic keys and sign/encrypt information without revealing the private key to the others.

PKCS#15 – PKCS 15 (Public Key Cryptography Standard 15) defines the standard for the storage of keys on smart cards. OpenSC implements PKCS#15 and thus stores everything in the directory 5015, creates certain files in defined formats, subdirectories and so on. Not all software implement PKCS#15. Many cards in EU and elsewhere have ID cards for their citizens with keys for digital signatures and authentication, and often those cards and not in PKCS#15 format.

OpenSC implements the standard APIs to smart cards

OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the PKCS #15 standard and the PKCS #11 API. It is possible to use the Smartcard via OpenSC with the Microsoft CNG library. CNG can be used together with CryptoAPI.

Vulnerability Details

CVE-2018-16418

A buffer overflow when handling string concatenation in util_acl_to_str in tools/util.c in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to cause a denial of service (application crash) or possibly have unspecified other impact.

CVE-2018-16427

Various out of bounds reads when handling responses in OpenSC before 0.19.0-rc1 could be used by attackers able to supply crafted smartcards to potentially crash the opensc library using programs.

Reference: Fixed out of bounds writes

https://github.com/OpenSC/OpenSC/commit/360e95d45ac4123255a4c796db96337f332160ad

OpenSC before 0.19.0-rc1 vulnerabilities summary:

Highlight concerns

Buffer overflow – Attacker would use a buffer-overflow exploit to take advantage of a program that is waiting on a user’s input. There are two types of buffer overflows: stack-based and heap-based. Heap-based, which are difficult to execute and the least common of the two, attack an application by flooding the memory space reserved for a program. Stack-based buffer overflows, which are more common among attackers, exploit applications and programs by using what is known as a stack: memory space used to store user input.

Double free errors – Double free errors occur when free() is called more than once with the same … Calling free() twice on the same value can lead to memory leak.

Endless recursion vulnerability – This weakness describes a logic error within the application, which results in an endless loop.

OpenSC-019.0 released 14th Sep 2018

Fixed multiple security problems (out of bound writes/reads, #1447):

CVE-2018-16391, CVE-2018-16392, CVE-2018-16393, CVE-2018-16418, CVE-2018-16419, CVE-2018-16420, CVE-2018-16421, CVE-2018-16422, CVE-2018-16423, CVE-2018-16424, CVE-2018-16425, CVE-2018-16426, CVE-2018-16427

URL shown as below:

https://github.com/OpenSC/OpenSC/releases

We are free to download apps in Google Play Store and App Store. And we believe the Apps are secure without any problem. Apple has removed “Adware Doctor” from the macOS App Store and claims that the program was uploading browser histories. As far as we know, our browse history collect by 3rd party is not the first time. Even though your defense software will be collect your internet activities in silent way. The collection of internet activities is hard to avoid today. Since we are living in so called big data world. On the other hand, App Store (Apple) found that threat actors may craft a malicious code embedded in application put in App store. The goal is going to read persistent account identifier. It looks that it is the way to receive your credential to evade the detection. So there is an security announcement on apple products this week (see below):

iOS 12: https://support.apple.com/kb/HT209106

Apple Support 2.4 for iOS: https://support.apple.com/kb/HT209117

Safari 12: https://support.apple.com/kb/HT209109

watchOS 5: https://support.apple.com/kb/HT209108

tvOS 12: https://support.apple.com/kb/HT209107

Adobe revealed that the Flash end of life will take place at the end of 2020. So we still can be use the flash. Perhaps computer products includes software and hardware.The key word vulnerability similar human not feeling well (sick) then receive medication. The patient will get well. So vulnerability occurs in cyber world do not give people any suprise! The vulnerabilities found in Adobe product not limit to Flash Player this week. Adobe ColdFusion is a commercial rapid web application development platform created by J. J. Allaire in 1995.Medical software manufacturer uses Adobe ColdFusion to more securely collect electronic clinical outcome assessment (eCOA) data.Digital solutions company uses Adobe ColdFusion to help midmarket companies manage eCommerce more effectively. Adobe has released security updates to address vulnerabilities in Adobe Flash Player and ColdFusion.

Adobe Security Bulletin can provides above details, see below:

ColdFusion – https://helpx.adobe.com/security/products/coldfusion/apsb18-33.html

Flash Player – https://helpx.adobe.com/security/products/flash-player/apsb18-31.html

Docker brings several new things to the table that the earlier technologies didn’t. It capable to all platform. It equivalent a multiple adapter. It is hard to avoid vulnerability happen on software and hardware. Docker no exception.

The specific vulnerability found on Aug 2018. For more details, please see below:

Docker for Windows Edge Release notes

https://docs.docker.com/docker-for-windows/edge-release-notes/

Docker for Windows Stable Release notes

https://docs.docker.com/docker-for-windows/release-notes/

The development of the cyber security mechanism involves preventive and corrective control. Security experts alert IT world that a unforseen cyber security loophole will be occurs when the poplarity of smartphone growth. Perhaps mobile device management (MDM) establish a way to rescue the enterprise firm business operation in demand of the usage of mobile phone devices.

Stephan Sekula from compass-security found design weakness on Airwatch Agent and VMware Content Locker. The problem is that it shown an Insufficient data protection feature of Airwatch agent and VMware content locker.

In vendor point of view, they beleive that the severity of such vulnerabilities in low risk. However we fully understand the following statement: You can use iCloud Keychain to access your stored logins and passwords, credit card details, and personal information. So, what do you think?

Airwatch and VMware official announcement shown as below:

https://www.vmware.com/security/advisories/VMSA-2018-0023.html

Vendor would like to bring below problems to your attention.

Apache Struts Remote Code Execution Vulnerability Affecting Cisco Products: August 2018

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180823-apache-struts

Cisco Umbrella API Unauthorized Access Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-umbrella-api

Cisco RV110W, RV130W, and RV215W Routers Management Interface Buffer Overflow Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180905-rv-routers-overflow