-
Status update – Multiple Vulnerabilities in Some ZTE CPE Terminal Products 19th Nov 2018
Preface: GPON stands for Gigabit Passive Optical Networks. GPON is defined by ITU-T recommendation series G.984.1 through G.984.6. ZTE model F670 is a GPON Optical Network Terminal designed for Fiber to the home (FTTH) scenario. Therefore, it is very popular in today’s Internet home use. Vulnerability findings: Some ZTE CPE terminal products encountered below vulnerability.…
-
Security Focus (Microsoft Edge) – Critical vulnerabilities fixed in November 2018 Patch Tuesday
Preface: Chakra is a JavaScript engine developed by Microsoft for its Microsoft Edge web browser. It is a fork of the JScript engine used in Internet Explorer. Description: The technical details issued by patch Tuesday not describe explicitly (see below). A remote code execution vulnerability exists in the way that the Chakra scripting engine handles…
-
Adobe Releases Security Updates – 13th Nov 2018
Preface: Integrated Windows Authentication utilizes Negotiate/Kerberos or NTLM to authenticate users based on an encrypted ticket/message passed between a browser and a server. This is the standard authentication algorithm for Microsoft products. Design weakness: Hacker steal the NTLM Credentials via PDF Files. They exploit NTLM hash leaks stealing a Windows user’s NTLM hashes. Official announcement:…
-
Node.js third-party modules vulnerability – Nov 2018
Preface: Node.js is an open source, cross-platform built on Chrome’s JavaScript runtime for fast and scalable server-side and networking applications. Known technical concerns: Node.js has a set of built-in modules which you can use without any further installation. In order to enhance the function and effectiveness, the 3rd party modules are available to operate with…
-
Security Updates for SIPROTEC and SICAM Products (Oct 2018)
Preface: SIPROTEC and SICAM – Siemens products and solutions for protection engineering, station automation, power quality, and measurement – can be connected directly and easily to MindSphere and other cloud-based platforms. What is MindSphere? MindSphere is an open cloud platform or “IoT operating system” developed by Siemens for applications in the context of the Internet…
-
VMware Releases Security Updates – November 09, 2018
Subject: VMware ESXi, Workstation, and Fusion updates address uninitialized stack memory usage Technical background: VMXNET3 (VMXNET Generation 3) is a virtual network adapter designed to deliver high performance in virtual machines (VMs) running on the VMware vSphere platform. How to enable it? 1. Power off your Virtual Appliance in the VMWare Console. 2. Right click…
-
Does CUJO IoT firewall will be affected by U-Boot vulnerabilities? Nov 2018
Preface: CUJO is the most adorable home firewall on the Market. Meanwhile if a threat is detected, CUJO smart firewall will tell the cloud what it has blocked so you can receive a notification on your mobile app to confirm it. Technical background: Cujo product working with U-boot. U-Boot is the bootloader. Meanwhile, it provides…
-
Cisco Releases Security Updates – November 07, 2018
Cisco Releases Security Updates – November 07, 2018 Cisco Stealthwatch Management Console Authentication Bypass Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-smc-auth-bypass Cisco Small Business Switches Privileged Access Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-sbsw-privacc Cisco Unity Express Arbitrary Command Execution Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-cue Cisco Meraki Local Status Page Privilege Escalation Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181107-meraki?vs_f=Cisco%20Security%20Advisory&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Cisco%20Meraki%20Local%20Status%20Page%20Privilege%20Escalation%20Vulnerability&vs_k=1
-
Linux (systemd) current status update – 7th Nov 2018
Linux (systemd) current status update – 7th Nov 2018 If you are the old folk. Perhaps you will familiar with (init)? The trend is going to replace the old mechanism (init) with new one (systemd). From techincal point of view, people satisfy the techincal features of “systemd”. However they are concern that such design are…
-
5th Nov 2018 – Apache Releases Security Advisory for Apache Struts. Is there any concern by Cisco?
US-CERT urge that stay alert for the former Apache Struts design weakness (CVE-2016-1000031 – Apache Commons FileUpload DiskFileItem File Manipulation Remote Code Execution) See whether does it effect cisco products? Since this vulnerability just happened yesterday. And therefore no response from Vendor (Cisco) in the moment. For details about this vulnerability. Please refer below URL…