Category Archives: Potential Risk of CVE

Potential Risk of CVE

Mozilla Releases Security Updates for Firefox Published March 13, 2018

Use After Free and Out-of-bounds Write vulnerabilities totally appears in Firefox web browser. It looks that there are more vulnerabilities found! The code for all projects in the Mozilla family (such as Firefox, Thunderbird, etc.) … Contains images and CSS files to skin the browser for each OS (Linux, Mac and Windows) … Support code for calling JavaScript code from C++ code and C++ code from JavaScript code, using XPCOM interfaces. So the hit rate of above vulnerabilities indeed possible and it make Firefox unsafe. In short, please see below url for reference. It is a official announcement.

https://www.mozilla.org/en-US/security/advisories/mfsa2018-06/

Potential Risk of CVE

CISCO vulnerabilities checklist – Mar 2018

1 Comment

As of this month, Cisco found more vulnerabilities just this month. It looks that network equipment provider will be felt Microsoft pain since they have web server and java applet. For more details, please refer below:

CVE-2018-0087 – A vulnerability in the FTP server of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to log in to the FTP server of the device without a valid password. (High)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-wsa

CVE-2018-0220 – A vulnerability in the web-based management interface of Cisco Videoscape AnyRes Live could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device. (Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-val

CVE-2018-0219 – A vulnerability in the web-based management interface of Cisco Unified Computing System (UCS) Director could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ucs

CVE-2018-0217 – A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to perform a command injection attack on an affected system.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-staros

*CVE-2018-0224 – A vulnerability in the CLI of the Cisco StarOS operating system for Cisco ASR 5000 Series Aggregation Services Routers could allow an authenticated, local attacker to execute arbitrary commands with root privileges on an affected operating system. (Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-staros1

*CVE-2018-0209 – A vulnerability in the Simple Network Management Protocol (SNMP) subsystem communication channel through the Cisco 550X Series Stackable Managed Switches could allow an authenticated, remote attacker to cause the device to reload unexpectedly, causing a denial of service (DoS) condition.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-550x

CVE-2018-0223 – A vulnerability in DesktopServlet in the web-based management interface of Cisco Security Manager could allow an unauthenticated, remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the web-based interface.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-sm

CVE-2018-0208 – A vulnerability in the web-based management interface of the (cloud based) Cisco Registered Envelope Service could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-res

CVE-2018-0144 – A vulnerability in the web-based management interface of Cisco Prime Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-pdcnm

*CVE-2018-0141 – A vulnerability in Cisco Prime Collaboration Provisioning (PCP) Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system.(Critical)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp

CVE-2018-0210 – A vulnerability in the web-based management interface of Cisco Data Center Network Manager could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-dcnm

Cisco Identity Services Engine (ISE)

CVE-2018-0215 – A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise4

*CVE-2018-0213 – A vulnerability in the credential reset functionality for Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to gain elevated privileges.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise2

*CVE-2018-0214 – A vulnerability in certain CLI commands of Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to execute arbitrary commands on the host operating system with the privileges of the local user, aka Command Injection.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise3

CVE-2018-0212 – A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise1

CVE-2018-0216 – A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device. (Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise5

* CVE-2018-0211 – A vulnerability in specific CLI commands for the Cisco Identity Services Engine could allow an authenticated, local attacker to cause a denial of service (DoS) condition.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise

* CVE-2018-0221 – A vulnerability in specific CLI commands for the Cisco Identity Services Engine (ISE) could allow an authenticated, local attacker to perform command injection to the underlying operating system or cause a hang or disconnect of the user session.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-ise6

Cisco Secure Access Control

CVE-2018-0207 – A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system. (Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs

CVE-2018-0147 – A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device.(Critical)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2

CVE-2018-0218 – A vulnerability in the web-based user interface of the Cisco Secure Access Control Server prior to 5.8 patch 9 could allow an unauthenticated, remote attacker to gain read access to certain information in the affected system.(Medium)

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs1

Potential Risk of CVE

Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization

Retrospectively Shibboleth(SAML IDP) found vulnerability on 13th Jan 2018 (CVE-2018-0486). The flaw was that it allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD. However there is an additional vulnerability found on Security Assertion Markup Language (SAML). It is the CVE-2018-0489. A multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal. It looks that it may causes serious headache to many people (webmaster).

During my penetration test engagement in past. I was surprised that no matter airline , financial and retail industries web online application solutions are deployed open source single-sign on resources. An incident occurred in Equifax which awaken the business world that open source application has potential inherent risk. It will jeopardize your firm reputation. Below url is the Security Advisory provided by Shibboleth. You can also find the details on attached picture diagram.

https://wiki.shibboleth.net/confluence/display/NEWS/2018/02/27/Shibboleth+Service+Provider+Security+Advisory

Potential Risk of CVE, Under our observation

CVE-2018-7642 – GNU Binutils 2.30

Are you aware of CVE-2018-7642? Bug found GNU Binutils 2.30 on 24th Feb 2018. However it noted to my interest that Binutils 2.30 released on 27th Jan 2018. But 3 weeks later, found a system bug causes system crash. The flaw is that it lack of check if “sym” is null. The bug was fixed on 28th Feb 2018. But I was wondering that GNU Binary Utilities, or binutils, are a set of programming tools for creating and managing binary programs, object files, libraries, profile data, and assembly source code. So if you are using GNU Binutils version 2.30, you must be staying alert! Perhaps the design flaw only encounter system crash. But it  is under my observation.

Potential Risk of CVE, Under our observation

Mar 2018 – A remote attacker could exploit some of these vulnerabilities to take control of an affected Cisco system.

6 Comments

The IT technology vulnerability like cough, running nose,..etc. Medicine please.

Cisco Prime Collaboration Provisioning Hard-Coded Password Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-cpcp

Cisco Secure Access Control System Java Deserialization Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-acs2

Cisco Web Security Appliance FTP Authentication Bypass Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180307-wsa

Reminder: Cisco Secure Access Control System

NOTE: This product is no longer being sold and might not be supported.

  • End-of-Life: latest Version – 5.8
  • End of Sale – 30-Aug-17
  • End of Software Maintenance – 30-Aug-18
  • End of Support – 31-Aug-20

 

Potential Risk of CVE, Under our observation

Google has released Chrome version 65.0.3325.146 – use-after-free vulnerability remediation

To be honest, web browser architecture looks messy due to plug-in, Flash,etc. Google has released Chrome version 65.0.3325.146 for Windows, Mac, and Linux. This version addresses vulnerabilities that an attacker could exploit to obtain access to sensitive information. A design flaw looks strange. I speculate that Chrome browser shared previous Flash vulnerability.A memory write is not a necessity. The “use-after-free” type of exploits is that the threat actor duplicate the virtual function table in use. My comment similar NIST, it is strongly recommended upgrade your Chrome to version 65.0.3325.146. Otherwise it is a nightmare especially enterprise IT campus. Below url is the official announcement by Google.

https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html

 

 

Potential Risk of CVE, Under our observation

Authentication Bypass Vulnerability in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway – CVE-2018-5314

4 Comments

A Cantonese mantra so called “蝦碌”. “蝦碌” means similar exclamation. Citrix product now falling into this situation. It allow remote attackers to execute a system command or read arbitrary files via SSH login prompt. From technical point of view it is similar Authentication Bypass Vulnerability.

In short, the official announcement shown below url:

https://support.citrix.com/article/CTX232199

Potential Risk of CVE, Under our observation

A never ending of Intel CPU design hiccups story – SgxPectre Attack

2 Comments

The design limitation of Intel Software Guard eXtensions (SGX) start discussion end of 2017. The security expertise focusing the topic on software development for SDK. Since the programming language are mainly written by programming language C and C++. A possibility factor predict that it will be lured for threat actors interest. And therefore a conference held last  year 2017 focus the specifics issue. Regarding to the observation of The Ohio State University observe (Department of Computer Science and Engineering), they found hack tricks which may allow to do in Intel Software Guard eXtension during SDK development. Perhaps Meltdown and Spectre incident override this issue. The security expert including myself awaken this week and starting the similar discussion. This attack so called SgxSpectre attack. No matter what will be happen in future. It tell the world that our electronic industry running too fast. It lack of business maturity model concept involvement.. Yes, we a living in a huge competition market which do not concerning long product life cycle. And the final way encounter hard to resolve issue occurs like the situation today. Technical article for your reference.

SGXPECTRE Attacks:
Leaking Enclave Secrets via Speculative Execution

http://web.cse.ohio-state.edu/%7Ezhang.834/papers/SgxPectre.pdf

Leaking Enclave Secrets via Speculative Execution

https://arxiv.org/pdf/1802.09085.pdf

Potential Risk of CVE, Under our observation

ISC Releases Security Advisories for DHCP, BIND

3 Comments

US-CERT encourages users and administrators to review ISC Knowledge Base Article.

https://kb.isc.org/article/AA-01565/75/CVE-2018-5732

https://kb.isc.org/article/AA-01562/74/CVE-2018-5734

Perhaps it is out of end user control!

What is ISC(Internet Systems Consortium)?

F Root System (ISC) – Enables users around the world to find top-level domains such as .com, .uk, .edu; Reliable anycast network with over 125 nodes; Hosted in local IXes, and on the Cloudflare network, managed by ISC. A vulnerability found on ISC (DHCP) and (BIND). Does it a precaution?

 

Potential Risk of CVE

Microsoft working with Intel to deliver CPU Microcode Fixes via Windows Updates

2 Comments

Cyber computer world news similar Hollywood celebrity scandal. It can’t maintain longer and easy to forget. Intel learned by experience. Thus invite Microsoft for assistance.

About CPU platforms around Spectre Variant 2 (CVE 2017-5715 (“Branch Target Injection”)).

I speculate that a technical problem occurs by Intel patch program last time cause by the following issue.

An invalid pool request has been made by the current thread. Typically this is at a bad IRQL level or double freeing the same memory allocation, etc.

KB4090007: Intel microcode updates

Applies to: Windows 10 version 1709Windows Server, version 1709 (Datacenter, Standard)

https://support.microsoft.com/en-us/help/4090007/intel-microcode-updates