-
CVE 2019-19492 (FreeSWITCH 1.6.10 through 1.10.1 has a default password in event_socket.conf.xml) Remote command execution – Last update: 26th Dec 2019
Preface: FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a versatile software implementation that runs on any commodity hardware. Background: FreeSWITCH listens on port 8021 by default and will accept and run commands sent to it after authenticating. By default commands are not accepted from remote hosts.…
-
Wish you a Merry Christmas 2019 (cyberX’mas).
I believe that the most annoying cyber security attack is the ransomware. We known that unplug or power off is one of the way to suspend the attack spread out. Yes, agree. Another way to avoid the infection of ransomware is think it over before open unknown email. Yes, During Xmas time you defense idea…
-
Not a serious mistake and could cause more trouble! (21st Dec, 2019)
Preface: Computer technology especially software application is the soul of digital world. Background: Pingbacks (also known as trackbacks) are a form of automated comment for a page or post, created when another WordPress blog links to that page or post. When you publish a new blog post, WordPress attempts to ‘ping‘ all the sites that…
-
Closer look of CVE-2019-1491 | Microsoft SharePoint Server Information Disclosure Vulnerability
Preface: Tip – Any system that supports Single-Sign On SSO is affected by the pass the hash attack. Background: Windows keeps hashes in LSASS memory, making it available for Single Sign On. Vulnerability details: An information disclosure vulnerability exists in Microsoft SharePoint when an attacker uploads a specially crafted file to the SharePoint Server.An authenticated…
-
Logon authentication integrate to AD can make your life easy. But sometimes it doesn’t (1st Dec 2019)
Preface: Modern world favor single sing-on function, SAML & application system authentication integrate with Microsoft active directory. Everybody might know such setup contain risk, but theoretically computer aim to make human life comfortable! Background: The Alcatel-Lucent OmniVista® 8770 Network Management System (NMS) is an all-in-one graphical management application that offers a unified view of your…
-
Black Friday was happened in New Orleans on 13th Dec 2019
Preface: Once upon a time, without internet. The Black Friday virus through floppy disk infected to your MS-DOS and make a trouble to your personal computer. Background: New Orleans declared a state of emergency and shut down its computers after a cyber security event. During a press conference on 14th Dec 2019, Mayor Cantrell confirmed…
-
Perhaps WordPress 5.3.1 is a short-cycle maintenance release. But recommend to do a update now (Posted date: 14th Dec 2019).
Preface: WordPress powers 34% of the internet in 2019, a 4% rise from the previous year. If you count only the CMS-built sites, then about 60% of them are WordPress. On Mar 2019, Expert found that a remote code execution vulnerability exists in WordPress. This is our story begin. Synopsis: The Cybersecurity and Infrastructure Security…
-
CVE-2019-17554 Apache Olingo OData 4.0 XML External Entity Injection – 4th Dec 2019
Preface: When you are sitting on the same boat. The risks at the time of the event are equal. Background: Open Data Protocol (OData) is an open protocol which allows the creation and consumption of queryable and interoperable RESTful APIs in a standard way. Apache Olingo is a Java library that implements the Open Data…
-
Intel CPU is charming! But I hate his design defect – 11thDec 2019
Preface: When Meltdown and Spectre discovered, the tech community questioned chip security. Security Focus: A new class of unprivileged speculative execution attacks to leak arbitrary data across address spaces and privilege boundaries (e.g., process, kernel, SGX, and even CPU-internal operations). Who is he? Side-channel attack targeting Intel chips, allowing hackers to effectively exploit design flaws…
-
Critical moment of defense mechanism
Preface: Sometimes while designing a software, you might have a requirement to hold some data (for reprocessing at later stage) for some duration. Some software do it within the memory in which they are running while others may create a temporary file for this purpose. Technical background: The original design of Trend Micro able transform…