-
CVE-2018-19018: Omron CX-Supervisor security alert! – Feb 2019
Preface: CX-Supervisor is dedicated to the design and operation of PC visualization and machine control in Omron controller applications. Technical background: Configuring CX supervisor in OPC and DDE is extremely simple if you have your DDE and OPC server with the SCADA package. CX supervisor contains a large number of predefined functions and libraries, and…
-
Linux Kernel before 4.20.8 kvm_ioctl_create_device Use-After-Free Vulnerability – Feb 2019
Preface: Linus Torvalds, he is the principal developer of the Linux kernel. Many Linux distributions and operating systems are based on Linus Torvalds design foundation. Synopsis: The module (virt/kvm/kvm_main.c) enables machines with Intel VT-x extensions to run virtual machines without emulation or binary translation. The module (virt/kvm/kvm_main.c) enables machines with Intel VT-x extensions to run…
-
About Linux kernel flaw (CVE-2018-5391) – Cisco information update
Preface: Cisco provide status update on CVE-2018-5391 on 18th Feb 2019 , it is the follow up action for Linux kernel flaw announced August last year. Synopsis: A decade ago, we said that the vulnerabilities of Microsoft windows will be jeopardize the IT world. Perhaps this statement not suitable today because Linux and open sources…
-
Do we really need cryptocurrency or bitcoin?
Preface: A new survey out of China shows surging interest in the bitcoin and cryptocurrency, with many keen to invest in crypto in the future – said Forbes News. Synopsis: The behaviour of human relies on banknotes perhaps will be replaced by another style of method substitution soon. It is hard to say that bitcoin…
-
CVE-2019-7304 – Canonical snapd Local Privilege Escalation Vulnerability – 15th Feb 2019
Preface: Why REST so popular? REST can be used over nearly any protocol, when used for web APIs it typically takes advantage of HTTP. Canonical snapd technical features: Snap is a software deployment and package management system.It capable to deliver and update your app on any Linux distribution for desktop, cloud, and Internet of Things.…
-
VMware announcement – they resolve mishandled file descriptor vulnerability in runc container runtime (15th Feb 2019)
Preface: Docker containers can be created in VMware. Therefore, VMware and Docker can work together. Therefore, they are not just competitors. Vulnerability background: Docker announce on 12th Feb 2019 that they are vulnerable for malicious attack. The vulnerability allows a malicious container to overwrite the host runc binary and thus gain root-level code execution on…
-
Container Privilege Escalation Vulnerability (CVE-2019-5736) Affecting Cisco Products – Products under investigation – 15th Feb 2019
Preface: Cisco MSE is distributed as an Open Virtual Appliance (OVA) for installation on a virtual appliance and as an ISO image for installation on a physical appliance. Cisco MSE acts as a platform (physical or virtual Cisco Mobility Services Engine [MSE] appliance) to deploy and run the Cisco services. Open Container Initiative overview: OCI…
-
Internet censorship versus Dark Web – 2019
Preface: Have you heard Internet censorship in South Korea?https://en.wikipedia.org/wiki/Internet_censorship_in_South_Korea Synopsis: This news seems make people nervous. The fact is that most of the people concern about the freedom of speech. Perhaps this topic not included in this discussion. Let’s take a look at the recent activities. Japan is going to execute infiltration to citizens smart…
-
Security Focus – CVE-2019-0626 Microsoft Windows DHCP Server Remote Code Execution Vulnerability (12th Feb 2019)
Preface: This vulnerability is included in MS Patch Tue this week. However the vulnerability is more critical than others. Since threat actor can be conduct a remote code execution through social engineering. Technical highlight: The official announcement told that attacker could exploit the vulnerability by sending a DHCP packet that submits malicious input to the…