A reminder to Schneider customer – official security alert! Preface: DLL file is in SysWOW64 folder and someone places a counterfeit dll in a folder that has higher priority compared to SysWOW64 folder, the operating system will use the counterfeit dll file, as it has the same name as the DLL requested by the application.…

CVE-2018-5407: new side-channel vulnerability on SMT/Hyper-Threading architectures (Fri, 2 Nov 2018) Spectre is a vulnerability that affects modern microprocessors that perform branch prediction. On most processors, the speculative execution resulting from a branch misprediction may leave observable side effects that may reveal private data to attackers. As predicted, there are more and more branch prediction…

As time goes by, we seen the cyber security coverage not limit to desktop, notebook and server. Even though WiFi chip set will be involved zero day vulnerability management cycle. Texas Instrument Microcontrollers expose that CC2640 and CC2650 has vulnerable to cyber attack. If the incoming data is over a certain length and continuous execution.…

Background: Libssh is a library written in C implementing the SSH protocol. It can be used to implement client and server applications. Vulnerability found on 17th Oct 2018: The technical details are as follows, please refer to the URL: https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20181019-libssh In addition, another important vulnerability announced this week is for your consideration. https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-prime-upload Reference: Libssh…

Just read articles recommend of my friend. It reminded me that Cisco Adaptive Security Appliance Software and Cisco Firepower Threat Defense Software encounter Denial of Service Vulnerability.This vulnerability recorded CVE-2018-15454. A design weakness resides in the Session Initiation Protocol (SIP) inspection engine of ASA and FTD software. The interim remedy solution shown as below: hostname(config)#…

Few years ago, when your friend ask you which is the best smartphone in the world. Seems it is easy to answer. Perhaps the zero day attack and malware wreak havoc today. So it is hard to answer those question in quick! We are now familiar with vulnerability terms especially stack-based buffer overflow, privilege escalation…

Apple Releases Multiple Security Updates on product especially IOS 12.1. Are you going to update as soon as possible or observe for a moment then action? Can we say, we are now alive Insane technology world and suffer with vulnerability daily! Safari 12.0.1 https://support.apple.com/en-us/HT209196 iCloud for Windows 7.8 https://support.apple.com/en-us/HT209198 iTunes 12.9.1 https://support.apple.com/en-us/HT209197 watchOS 5.1 https://support.apple.com/en-us/HT209195…

A flaw was found in xorg-x11-server. X.Org Server is the free and open-source implementation of the display server for the X Window System. It is very common in computing environment. But IT administrator must stay alert whether your have Linux Desktop install on top of your VM infrastructure. Since a flaw was found in xorg-x11-server…

Advantech WebAccess remain vulnerable (8.3.1 & 8.3.2) When vulnerability allows an attacker to execute “arbitrary code”, it typically means that the hacker can run any command. Although critical facilities especially Petroleum, electricity, Gas and water SCADA infrastructure are prohibited setup internet access function. However to cope with modernization. It is hard to avoid to do…

Cisco Webex Productivity Tools and the Cisco Webex Meetings Desktop App Releases Security Updates – October 24, 2018 Due to design weakness of ACL, WebExService that can execute arbitrary commands at SYSTEM-level privilege. Below remedy only reset the service to the default permission. sc sdset webexservice D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPLORC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD) But you should update your Cisco Webex Meetings…