Siemens – CVE-2019-6569 (Do not contempt this vulnerability)

Preface: Industrial Ethernet has been the network of choice in factory auto-mation for many years and offers a powerful communication basis with PROFINET-based solutions.

Vulnerability details: A vulnerability has been identified in Scalance X-200 (All versions), Scalance X-300 (All versions), Scalance XP/XC/XF-200 (All versions <V4.1). The monitor barrier of the affected products insufficiently blocks data from being forwarded over the mirror port into the mirrored network.

Impact: An attacker might use this behaviour to transmit malicious packets to systems in the mirrored network. The worst scanario is that it go direct to facilities like SIMATIC S7-400 advanced controller thus conducting cyber attack directly see whether can find zero-day of attack.

Siemens official announcement – refer to url: https://cert-portal.siemens.com/productcert/pdf/ssa-557804.pdf

CVE-2019-1002101: kubectl fix potential directory traversal (4th Apr 2019)

Preface: The vulnerability if not require attacker conduct scam to persuade a user. It is a extreme dangerous vulnerability.

Technical background of Kubernetes: Kubernetes (often referred to as K8s) is an open source system for automatically deploying, extending, and managing containerized applications. The system was designed by Google and donated to the Cloud Native Computing Foundation (now the Linux Foundation).

Synopsis: The container escape vulnerability in runc awaken docker users in regard to cyber security in their domain. Perhaps the vulnerability of CVE-2019-1002101 is in high severity level. But strongly believed that it is an alert. Hey administrator, staying alert! Should you have interest receive a quick understanding, please refer to attached diagram.
Kubernetes has released software updates at the following link: https://github.com/kubernetes/kubernetes/releases

Apache Releases Security Update for Apache HTTP Server – 4th April 2019

Alert: The Apache Software Foundation has released Apache HTTP Server version 2.4.39 to address multiple vulnerabilities.

  • mod_auth_digest access control bypass (CVE-2019-0217)
  • mod_ssl access control bypass (CVE-2019-0215)
  • mod_http2, possible crash on late upgrade (CVE-2019-0197)

CVE-2019-0211 bring to my attention. For the synopsis of this matter, please refer to attached diagram.

Remedy: The Apache Software Foundation has released Apache HTTP Server version 2.4.39 to address multiple vulnerabilities. See the URL for more information.

https://httpd.apache.org/security/vulnerabilities_24.html

Client negligence (misconfiguration), AWS reputation suffer! 3rd Apr 2019

Preface: 540 Million Facebook Records Leaked

Who bare the responsibility? Misconfiguration

Headline News: Hundreds of millions of Facebook records exposed on Amazon S3 cloud!
See the link below for details:
https://www.forbes.com/sites/kateoflahertyuk/2019/04/03/facebook-exposes-540-million-user-records-what-you-need-to-know/#35a8f7043fd7

Observation: The incident shown that it is not difficult to keep track our web activities. A webhook (HTTP push API) is a way for an app to provide other applications with real-time information. As a result, what you are doing is that what thrid party get!
I believe that all related informations over there will be found on Dark Web?

CVE-2018-19466 – Portainer LDAP Credentials Storage Information Disclosure Vulnerability (3rd Apr 2019)

Preface: Today, the stored password is not encrypted like walking around without clothes!

Technical background: Portainer is a lightweight management UI which allows you to easily manage your different Docker environments (Docker hosts or Swarm clusters). It allows you to manage your all your Docker resources (containers, images, volumes, networks and more) ! It is compatible with the standalone Docker engine and with Docker Swarm mode.

Vulnerability: The affected software stores LDAP credentials in cleartext and performs insufficient security checks on API calls that allow the retrieval of LDAP credentials.

Remedy: Portainer has released software updates at the following url: https://github.com/portainer/portainer/releases/tag/1.20.0

CVE-2019-5729 – Splunk Python SDK Improper TLS Server Certificate Verification Vulnerability(2nd Apr 2019)

Preface: Splunk is powerful, it can extract cookie of web connections. If client connection still alive, hacker can hijack and get the connection.

Vulnerability details: A vulnerability in Splunk Python SDK could allow an unauthenticated, remote attacker to bypass security restrictions on a targeted system. An attacker could exploit this vulnerability by executing a man-in-the-middle attack to bypass access restrictions on the system.

Design weakness: Due to improper verification of untrusted TLS server certificates

Remedy: Splunk has released software updates (refer url) – https://github.com/splunk/splunk-sdk-python/releases

CVE-2019-10125: aio_poll function hits vulnerability (1st Apr 2019)

Preface: Linus Benedict Torvalds, he is the principal developer of the Linux kernel, which became the kernel for many Linux distributions and operating systems.

Vulnerability details: An issue was discovered in aio_poll() in fs/aio.c in the Linux kernel through 5.0.4. A file may be released by aio_poll_wake() if an expected event is triggered immediately (e.g., by the close of a pair of pipes) after the return of vfs_poll(), and this will cause a use-after-free.

Impact: An attacker could exploit this vulnerability by executing an application that submits malicious input to the targeted system. A successful exploit could allow the attacker to execute arbitrary code and completely compromise the system.

Remedy:https://patchwork.kernel.org/patch/10828359/

Why APT attack changing their shape?

Preface: We known so far that APT attack aim to lockdown specify attack target. The target will be specifics government regime and the their revenue. This is the modern way not require engage the traditional war.

Synopsis: APT attack lure people attention is that they form a structure attack and exploit with malware attacking major public facilities. For instance, Nuclear power station, water supply and Gas system. No matter it is a Botnet DDoS or implant malware conducting sabotage activities. It is a time consuming action. Perhaps above action didn’t fully exploit metamorphic definition. On my seen that a new generation of attack mechanism will be frequently exploit by APT group in future. The design will be similar LockerGoga Ransomware.

LockerGoga Ransomware:
Expert found that LockerGoga does not have any self-propagation mechanisms (needs to be manually deployed). But later on found that it relies SMB protocol (manually copy files from computer to computer). They are jeopardizing in supply chain industry now. But I believe that it the a pilot run now.

For more details, please refer url below: https://www.jdsupra.com/legalnews/lockergoga-ransomware-hits-manufacturer-94292/

Specifications: https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/ransom.win32.lockergoga.aa

CVE-2019-10063 – Security update for Flatpak, 29th Mar 2019.

Preface: Coding is the process of translating and writing codes from one language to another support operating system platform.

What is Flatpak?

If Linux user found that the new application not available in the App Stores. He can do the installation via the DEB or RPM packages. Some of them are available via PPAs (for Debian based distributions) and if nothing, one can build from the source code. Flatpak provide a 3rd way.

Vulnerability Details: The vulnerability exists because the affected software does not use the seccomp filter to prevent sandbox applications from using TIOCSTI IOCTL.

Reason:

The snapd default seccomp filter for strict mode snaps blocks the use of the ioctl() system call when used with TIOCSTI as the second argument to the system call. But it didn’t! The fact is that restriction could be circumvented on 64 bit architectures because it performs a 64-bit comparison,but the system call is defined with a 32-bit command argument in the kernel.

Similar design flaw discovered in libseccomp package!

Remedy: https://github.com/flatpak/flatpak/releases

Observation: Similar design flaw might found soon in other software.

VMware security updates – 29th Mar 2019

Synopsis: session hijacking, sometimes also known as cookie hijacking is the exploitation of a valid computer session(sometimes also called a session key) to gain unauthorized access to information or services in a computer system.

In software development, time of check to time of use (TOCTOU, TOCTTOU or TOC/TOU) is a class of software bugs caused by changes in a system between the checking of a condition (such as a security credential) and the use of the results of that check.

Out-of-Bounds Read. The program reads data from outside the bounds of allocated memory. Buffer overflow is probably the best known form of software security vulnerability.

Current Status: VMware has been addressed above issues in their product. For more details, please refer to url below:

vCloud Director SP – https://www.vmware.com/security/advisories/VMSA-2019-0004.html

ESXi, Workstation and Fusion – https://www.vmware.com/security/advisories/VMSA-2019-0005.html

antihackingonline.com