-
Cisco HyperFlex Software Unauthenticated Root Access Vulnerability (CVE-2019-1664) – 20th Feb 2019
Preface: HyperFlex is Cisco’s hyper-converged infrastructure (HCI) platform. It enable centralized management and enhanced operation efficiency. Vulnerability detail: The vulnerability resides in the hxterm service of the Cisco HyperFlex software package and it can “allow an unauthenticated, local attacker to gain root access to all nodes in the cluster, said Cisco. If the following occurs:…
-
Security Focus – CVE-2018-13888
Preface: This design flaw has attracted me. Perhaps the supplier has no formal remediation solution yet. But the impact of this vulnerability seems to be broad! Vulnerability detail: There is potential for memory corruption in the RIL daemon due to the following reason. The location of dereference of memory is outside the allocated array length…
-
CVE-2018-19018: Omron CX-Supervisor security alert! – Feb 2019
Preface: CX-Supervisor is dedicated to the design and operation of PC visualization and machine control in Omron controller applications. Technical background: Configuring CX supervisor in OPC and DDE is extremely simple if you have your DDE and OPC server with the SCADA package. CX supervisor contains a large number of predefined functions and libraries, and…
-
Linux Kernel before 4.20.8 kvm_ioctl_create_device Use-After-Free Vulnerability – Feb 2019
Preface: Linus Torvalds, he is the principal developer of the Linux kernel. Many Linux distributions and operating systems are based on Linus Torvalds design foundation. Synopsis: The module (virt/kvm/kvm_main.c) enables machines with Intel VT-x extensions to run virtual machines without emulation or binary translation. The module (virt/kvm/kvm_main.c) enables machines with Intel VT-x extensions to run…
-
About Linux kernel flaw (CVE-2018-5391) – Cisco information update
Preface: Cisco provide status update on CVE-2018-5391 on 18th Feb 2019 , it is the follow up action for Linux kernel flaw announced August last year. Synopsis: A decade ago, we said that the vulnerabilities of Microsoft windows will be jeopardize the IT world. Perhaps this statement not suitable today because Linux and open sources…
-
Do we really need cryptocurrency or bitcoin?
Preface: A new survey out of China shows surging interest in the bitcoin and cryptocurrency, with many keen to invest in crypto in the future – said Forbes News. Synopsis: The behaviour of human relies on banknotes perhaps will be replaced by another style of method substitution soon. It is hard to say that bitcoin…
-
CVE-2019-7304 – Canonical snapd Local Privilege Escalation Vulnerability – 15th Feb 2019
Preface: Why REST so popular? REST can be used over nearly any protocol, when used for web APIs it typically takes advantage of HTTP. Canonical snapd technical features: Snap is a software deployment and package management system.It capable to deliver and update your app on any Linux distribution for desktop, cloud, and Internet of Things.…
-
VMware announcement – they resolve mishandled file descriptor vulnerability in runc container runtime (15th Feb 2019)
Preface: Docker containers can be created in VMware. Therefore, VMware and Docker can work together. Therefore, they are not just competitors. Vulnerability background: Docker announce on 12th Feb 2019 that they are vulnerable for malicious attack. The vulnerability allows a malicious container to overwrite the host runc binary and thus gain root-level code execution on…
-
Container Privilege Escalation Vulnerability (CVE-2019-5736) Affecting Cisco Products – Products under investigation – 15th Feb 2019
Preface: Cisco MSE is distributed as an Open Virtual Appliance (OVA) for installation on a virtual appliance and as an ISO image for installation on a physical appliance. Cisco MSE acts as a platform (physical or virtual Cisco Mobility Services Engine [MSE] appliance) to deploy and run the Cisco services. Open Container Initiative overview: OCI…
-
Internet censorship versus Dark Web – 2019
Preface: Have you heard Internet censorship in South Korea?https://en.wikipedia.org/wiki/Internet_censorship_in_South_Korea Synopsis: This news seems make people nervous. The fact is that most of the people concern about the freedom of speech. Perhaps this topic not included in this discussion. Let’s take a look at the recent activities. Japan is going to execute infiltration to citizens smart…