Category Archives: Potential Risk of CVE

Potential Risk of CVE, Under our observation

May 18, 2018 – ISC Releases Security Advisories for BIND

ISC Releases Security Advisories for BIND on May 18, 2018. This alert awaken my defense thinking. I was written few articles about the electronic war and the cyber arsenal. But forgot to contains a scenario which annoucned by ISC today (Security Advisories for BIND). Regarding to to the subject (ISC Releases Security Advisories for BIND) indeed described a hacking scenario who focus to doing bad things to the world (distrubuted deniel of services to worldwide DNS services). It is not difficult to understand the way. The method is CVE-2018-5737 + CVE-2018-5736.

Such cyber attack on phase 1 is one to many distribution (Initiating a Zone Transfer), then execute vulnerability (CVE-2018-5737) . As a result the smartphone, server and workstation all can’t work because no DNS service will be available! You can find hints in attached diagram. For more details about the vulnerabilities, please refer below url for references.

CVE-2018-5737: BIND 9.12’s serve-stale implementation can cause an assertion failure in rbtdb.c or other undesirable behavior, even if serve-stale is not enabled.

https://kb.isc.org/article/AA-01606/0

CVE-2018-5736: Multiple transfers of a zone in quick succession can cause an assertion failure in rbtdb.c

https://kb.isc.org/article/AA-01602/0

Potential Risk of CVE

16th May 2018 – Cisco security update awaken SDLC (software development life cycle) process.

The vulnerabilities occurred so far, it awaken the SDLC (software development life cycle) process. The design bug common appear in development cycle. The bug checker may record in details and put in the report let the decision maker know the actual statis. Project management office member better to use your knowledge learned during PMP or Prince 2 lesson. Don’t let your certificate become a paper!

Default user username cannot be changed looks not strange to IT guy!

Release 1.1.0 – The default username is maglev and cannot be changed.

Release 1.0 – The default username is grapevine and cannot be changed.

Cisco Digital Network Architecture Center Static Credentials Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dnac

Potential Risk of CVE

May 16, 2018 – Cisco Releases Security Updates

Cisco Releases Security Updates

Original release date: May 16, 2018

  • Digital Network Architecture Center Static Credentials Vulnerability
  • Digital Network Architecture Center Authentication Bypass Vulnerability
  • Digital Network Architecture Center Unauthorized Access Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-dna

Enterprise NFV Infrastructure Software Linux Shell Access Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-nfvis

Meeting Server Media Services Denial-of-Service Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-msms

Identity Services Engine EAP TLS Certificate Denial-of-Service Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-iseeap

IoT Field Network Director Cross-Site Request Forgery Vulnerability

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180516-fnd

Potential Risk of CVE

Published Wednesday, May 16, 2018 – Red Hat Addresses DHCP Client Vulnerability

Red Hat has released security updates to address a vulnerability in its Dynamic Host Configuration Protocol (DHCP) client packages for Red Hat Enterprise Linux 6 and 7. An attacker could exploit this vulnerability to take control of an affected system. See whether below command syntax will be the root cause of this problem?

For more details, please refer below url for reference.

Bug 1567974 – (CVE-2018-1111) – Command injection vulnerability in the DHCP client NetworkManager integration script

https://bugzilla.redhat.com/show_bug.cgi?id=1567974

Potential Risk of CVE, Under our observation

May 15, 2018 – VMware releases security update. Alert!

VMware just released a security update to address a vulnerability in NSX SD-WAN Edge by VeloCloud. I couldn’t find techincal details but vendor state that VeloCloud by VMware will be removing the web ui component service from the product in future releases. My speculation is that the existing design limitation can merge with former vulnerability (CVE-2017-4947). As a result it cause risk happens. See below hints for reference.

There are two different product editions of NSX: NSX for vSphere and NSX for Multi-Hypervisor (MH). It’s speculated they will merge down the road, but for many possible, or soon to be, users of NSX, it doesn’t matter, because they are used to support different use cases. NSX for vSphere is ideal for VMware environments, while NSX for MH is designed to integrate into cloud environments that leverage open standards, such as OpenStack.

Vulnerability Details for reference:

Unauthenticated Command Injection vulnerability in VMware NSX SD-WAN by VeloCloud

https://www.vmware.com/security/advisories/VMSA-2018-0011.html

CVE-2017-4947: vRealize Automation, vSphere Integrated Containers, and AirWatch Console updates address multiple security vulnerabilities

https://www.vmware.com/security/advisories/VMSA-2018-0006.html

Potential Risk of CVE

Published: 8th May 2018 – MS-Sharepoint Security Vulnerability

Coming GDPR data protection policy penality drive me to draft this sharepoint point vulnerability discussion topic. Microsoft Dynamics CRM and Microsoft SharePoint are two powerful enterprise applications and very popular in the business world. As a matter of fact many enterprise firm integrate their dataware house platform to Microsoft sharepoint system. However Microsoft sharepoint architecture contained fundemental design weakness. You can take a look with your Active directory server and sharepoint server architecture. A common solution installed both web and sharepoint server in the same place (product design limitation). The system architect will install a proxy server as a front end to improve the isolation level. Refer to attached diagram, the sharepoint vulnerabiities merge with Win32k Elevation of Privilege Vulnerability will be compromise whole sharepoint system. The effective day of New GDPR data protection policy will be held on 25th May 2018. The company will be sentence if they are fail to data protection policy. The penality is that for lesser offences, the fine will be halved to €10million, or up to 2 percent of the offending organization’s annual revenue. So we must be stay alert!

Reference:

CVE-2018-8155 | Microsoft SharePoint Elevation of Privilege Vulnerability

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8155

CVE-2018-8168 | Microsoft SharePoint Elevation of Privilege Vulnerability

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8168

CVE-2018-8156 | Microsoft SharePoint Elevation of Privilege Vulnerability

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8156

CVE-2018-8149 | Microsoft SharePoint Elevation of Privilege Vulnerability

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8149

CVE-2018-8164 | Win32k Elevation of Privilege Vulnerability

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8164

 

 

Potential Risk of CVE, Under our observation

Published Monday, May 14, 2018 – Adobe Releases Security Updates

 

Death Note is a Japanese manga series. The story describ that if someone’s name is written on it while the writer imagines that person’s face, he or she will die. The computer and smartphone devices who installed adobe acrobat reader are in the similar situation. The vulnerabilities in Adobe Acrobat and Reader and Photoshop CC causes a remote attacker could exploit some of these vulnerabilities to take control of an affected system. As a result the system has been compromised. Please be reminded that the Adobe design flaw are critical level of vulnerabilities. IT admin must be staying extra alert.

See below security updates for reference.

Security updates available for Adobe Acrobat and Reader:

https://helpx.adobe.com/security/products/acrobat/apsb18-09.html

Security updates available for Adobe Photoshop CC:

https://helpx.adobe.com/security/products/photoshop/apsb18-17.html

Potential Risk of CVE

CVE-2018-10548 – allows remote LDAP servers to cause a denial of service (12th May 2018)

13 Comments

Have you watch a movie Saturday night fever. From technology world point of view, they are every night fever. As times go by, Cloud computing, single sign-on system become a base in technology world. Even though security expert concern about the data privacy matters or single sign-on unforeseen cyber security issues.  A intangible force driven the world agree the technology silently. We do not have the right to say no, right? Application developers or CSO must be staying alert of your PHP language application. The design weakness of the PHP looks possible transform himself become a culprit. And thus create trouble to your web application. Should you have interest to know more. Please refer to below url for reference.

CVE-2018-10548:

An issue was discovered in PHP before 5.6.36, 7.0.x before 7.0.30, 7.1.x before 7.1.17, and 7.2.x before 7.2.5. ext/ldap/ldap.c allows remote LDAP servers to cause a denial of service (NULL pointer dereference and application crash) because of mishandling of the ldap_get_dn return value.

https://www.securityfocus.com/bid/104019

#76248 Malicious LDAP-Server Response causes Crash:

https://bugs.php.net/bug.php?id=76248

 

 

Potential Risk of CVE, Under our observation

Security Alert – Debug Exception May Cause Unexpected Behavior (8thMay2018)

CVE-2018-8897 indicate that an unexpected behavior for debug exceptions. A possibility way causes a local attacker could exploit this bug to obtain sensitive information. Regarding to my observation, this issue found on 2008 by system developer accidentally. However the dangerous issue of this vulnerability is that it is difficult to detect. It is hard to imaginate the actual status when threat actor successful re-engineering this bug transform to cyber attack. In the moment, no idea what will be the next. Should you have interest about the details, please refer below url for reference.

https://www.kb.cert.org/vuls/id/631579

Potential Risk of CVE

Microsoft Patch Tue security Focus – 8th May 2018

Microsoft Patch Tue transform to weekly routine security process. As far as I know, IT technical experts are busy for change management control schedule (time window) weekly. For the evaluation of each vulnerability most likely will be do a quick walk-through. As a  matter of fact, engage the patch updating exercise looks time consuming. IT Dept will be do the patch management out of office hour, earlier morning or Sunday morning. But think it over, our existing business world seems operate in 24 hours. Another new round of patch announcement will be held on coming Tue.  And therefore implement managed security services become a significant pathway.

Remark: We are all under demanding competitions environment!

CredSSP updates for CVE-2018-0886

My security focus for Microsoft Patch Tue this week will be observe the vulnerability of Credential Security Support Provider protocol. Regarding to my observation, vendor doing 3 times of security enhancement last 3 months. For details, please refer to diagram above.

The spectra and meltdown vulnerabilities found this year bring the people focus to CPU design architecture. As a matter of fact, memory management looks critical today because of APT attack. Heterogeneous systems that integrate a multicore CPU and a GPU on the same die are ubiquitous. On these systems, both the CPU and GPU share the same physical memory as opposed to using separate memory dies.

In order to avoid Credential Theft , what is the Secure practice?

  1. Prevent network logon for local accounts
  2. Prevent credentials from remaining in-memory when connecting remotely (out of IT operation control)
  3. Prevent access to in-memory credentials (Control by application developers)
  4. Leverage protected users and control privileged users

In short, please refer to Microsoft official announcement for reference.

https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2018-0886