Category Archives: Potential Risk of CVE

Netapp-How I met your Java debugger(CVE-2018-5486)

How I met your Java debugger is not a new hacking technique. It announced in 2014. Hacker is able to turn any open JDWP service into reliable remote code execution. But it can only execute in inside compartment (exploit inside). JDWP is one component of the global Java debugging system, called the Java Platform Debug Architecture. Hardware storage vendor (Netapp) found vulnerabiliy on their product. A design weakness of Java Platform Debug Architecture with their products cause local code execution vulnerability in OnCommand Unified Manager (Linux 7.2 and above). Vendor (Netapp) provides remediation, for more detail please refer below url for reference.

https://security.netapp.com/advisory/ntap-20180425-0001/

Hacker also interest of the SIEM operation (CVE-2018-1418)

SIEM functions play an important role in the IT infrastructure. And therefore the security architect plan to design the SIEM not only focusing for log collection, correlation, alert and report templates. Meanwhile, a critical item must be added to the design objective. That is how to hidden your SIEM. For instance, hacker target most likely is the IT admin or CSO because they have confidental data or priviligies ID on hand. Besides, hacker also interest of the SIEM operation.

IBM Q Radar announce that a vulnerability occurs in their SIEM. Q-Radar admin must stay alert!

Since IBM do not mention what is the possible cause of this vulnerability.
Reveiw their windows log event collection method. My speculation is shown as below:
QRadar requires XPath query to communcation with windows server.
An XPath query is a log source parameter that filters specific events when the query communicates with a Windows 2008 or newer event log.
The XPath injection also leads to extracting document structure and modify the document information in addition to escalate privileges.

For more details. please see below url for reference.

CVE-2018-1418 – IBM Security QRadar SIEM privilege escalation

https://exchange.xforce.ibmcloud.com/vulnerabilities/138824

2nd May 2018 – Windows Host Compute Service Shim Remote Code Execution Vulnerability

A low level container management API in Hyper-V called the Host Compute Service (HCS). HCS compatible written in Go (and used by Docker), and the other is written in C#.
On 2nd of May, Microsoft official announcement urge end user who deployed Host Computer Service (HCS) requires to do the security update. Microsoft has patched their own infrastructure hosting offerings, as have Microsoft partners with Google among them.

Technical details:

(CVE-2018-8115) –  Duplicate the original CVE technical details.

A remote code execution vulnerability exists when the Windows Host Compute Service Shim (hcsshim) library fails to properly validate input while importing a container image. To exploit the vulnerability, an attacker would place malicious code in a specially crafted container image which, if an authenticated administrator imported (pulled), could cause a container management service utilizing the Host Compute Service Shim library to execute malicious code on the Windows host.

 

For remediation of design limitation, new version of hcsshim v0.6.10 enhance sanitize function. So called sanitize function did not use below command.
Example:

p := xxxxx.UGCPolicy()
user.Name, user.Address = p.Sanitize(user.Name),p.Sanitize(user.Address)

But do you have any idea in regards to below command syntax?

}

func makeError(err error, title, rest string) error {
 // Pass through DLL errors directly since they do not originate from HCS.
 if _, ok := err.(*syscall.DLLError); ok {
 return err
 }
 return &HcsError{title, rest, err}
}

The new release of the hcsschim able to addresses security fixes.For more details, please refer below url for reference.

Change to address CVE-2018-8115

https://github.com/Microsoft/hcsshim/releases/tag/v0.6.10

Cisco Releases Security Updates Original release date: May 02, 2018

Cisco WebEx Advanced Recording Format Remote Code Execution Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-war

Reminder: My comment is that enterprise firm CSO may require to update the security policy on how to use the Cisco webex.

Cisco Prime File Upload Servlet Path Traversal and Remote Code Execution Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-prime-upload

Cisco Secure Access Control System Remote Code Execution Vulnerability – https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180502-acs1

Remark: Cisco Secure ACS product offering is no longer being sold after August 30, 2017

CVE-2018-10299 – integer overflow jeopardize Ethereum Zone

In the view of cryptocurrency supporter, Ethereum is the best. The cyber incident occured in cryptocurrency world so far shift the security focus to e-wallet (end point). Perhaps the cyrpto platform itself contains design limitation. However the end point design of crypto currency platform looks have more space for improvement.

If you install the MetaMask browser plugin, you can manage your accounts in your browser. The keys are stored only on your browser, so you are the only one who has access to your account and the private key. But when the web browser encounter vulnerability. It may jeopardize your private key. So security urge the crypto currency owner make use of hardware token instead of software.

We understand that web3.js is a collection of libraries which allow you to interact with a local or remote Ethereum node, using a HTTP or IPC connection. Java application encounter  vulnerabilities caused end user encounter cyber attack is not a news. Above informative diagram shown the integer overflow vulnerability of Ethereum case study involves java applet on the client side. As a front end application, Java application may not aware that he is the accomplice with the cryptocurrency cyber security incident.

Return to reality. Below headline news shown the vulnerabilities occurred in Ethereum (see below for reference). I am wishing that above details can provides hints to you for reference.  Let’s us awaken the design weakness of Ethereum cypto currency platform.

Critical EOS Smart Contract Vulnerability Discovered By Auditing Firm

https://bitcoinexchangeguide.com/critical-eos-smart-contract-vulnerability-discovered-by-auditing-firm/

 

Siemens – (CVE-2018-4832): Siemens Security Advisory by Siemens Product 18th Apr 2018

The Gas and Petroleum industries requires automation to enhance their overall operation in last decade. And therefore the automation system setup requires Supervisory control and data acquisition (SCADA). We noticed that hackers targeted SCADA system installed in nuclear power facilities. We are living in digital age and therefore electricity power supply similar air and water. So system automation hardware vendor has responsibility to hardening their system design. Siemens found vulnerability in their Automation Technology Process control systems (PCS 7) on April last month. For more details, please refer below url for reference.

Vulnerability details

https://cert-portal.siemens.com/productcert/pdf/ssa-348629.pdf

My Speculation:

1. A denial of service vulnerability exists in the remote procedure call (RPC) facility due to a failure in communicating with the NTLM security provider when performing authentication of RPC requests. An anonymous attacker could exploit the vulnerability by sending a specially crafted RPC authentication request to a computer over the network. An attacker who successfully exploited this vulnerability could cause the computer to stop responding and automatically restart.

2. GetMachineName ( ) copies machine name to a fixed 32 byte buffer causes problem occurs.

Ethereum – CVE-2018-10468

As far as I remember, the goal of bitcoin technology aim to replace the traditional payment. In additional, the slogan of bitcoin is that it can provides a more secure way to send the money and it is hard to counterfeit.  We heard cyber security incidents happened in bitcoin industry frequently last year.  Ethereum , a most relieable and popular crypto currency in the bitcoin industy.  A vulnerability found in Ethereum that it give a way to hacker do the re-engineering. Hacker is able to transform the transfer function ( transferFrom()). Detail shown as below:

The transferFrom function of a smart contract implementation for Useless Ethereum Token (UET), an Ethereum ERC20 token, allows attackers to steal assets (e.g., transfer all victims’ balances into their account) because certain computations involving _value are incorrect, as exploited in the wild starting in December 2017, aka the “transferFlaw” issue.

For more details, please refer below url for reference.

https://peckshield.com/2018/04/28/transferFlaw/

6 vulnerabilities in some Huawei products – The culprit,SOAP!

The Simple Object Access Protocol (SOAP) invoking objects on remote machine.
It is XML-based messaging thus run on top of HTTP/HTTPS.
That is the reason why firewall cannot significant block them.

An announcement issued by HUAWEI. For more details, please refer below url for reference.

Security Advisory – Six Vulnerabilities in Some Huawei Products

http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20180207-01-soap-en

Attention: PeopleSoft Enterprise PeopleTools (Rich Text Editor) vulnerability – Apr 2018

CVE# Product Component Protocol Remote
Exploit
without
Auth.?
CVSS VERSION 3.0 RISK (see Risk Matrix Definitions) Supported Versions Affected Notes
Base
Score
Attack
Vector
Attack
Complex
Privs
Req’d
User
Interact
Scope Confid-
entiality
Inte-
grity
Avail-
ability
CVE-2018-2772 PeopleSoft Enterprise PeopleTools Rich Text Editor HTTP No 8.8 Network Low Low None Un-
changed
High High High 8.54, 8.55, 8.56

Attention: CVE-2018-2772

Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of PeopleSoft Enterprise PeopleTools accessible data as well as unauthorized read access to a subset of PeopleSoft Enterprise PeopleTools accessible data.

Official announcement shown below url for reference.

http://www.oracle.com/technetwork/security-advisory/cpuapr2018-3678067.html

CVE-2018-0229: See whether is there any attack make use of this vulnerability transform another type of attack in future?

Seems firewall administrator do not take the single sign-on authentication method in firewall. Perhaps it can’t fulfill audit requirement.  Cisco found SAML Authentication Session Fixation Vulnerability. The vulnerability exists because there is no mechanism for the ASA or FTD Software to detect that the authentication request originates from the AnyConnect client directly. An attacker could exploit this vulnerability by persuading a user to click a crafted link and authenticating using the company’s Identity Provider (IdP).  My concerns is that see whether is there any attack make use of this vulnerability transform another type of attack in future?

Cisco Official announcement is shown as below:

https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180418-asaanyconnect