Preface: It is rare that software application do not have design weakness. If there is a perfect software appears. Perhaps we can say, it is created by God. Background: Ghidra is a software reverse engineering framework developed by NSA that is in use by the agency for more than a decade. Design weakness: When you…

Preface: CIS Center for Internet Security Urge PHP customer stay alert of the zero-day vulnerability. It could allow for Arbitrary Code Execution. 27th Sep 2019 Vulnerability details: A vulnerability has been discovered in PHP, which could allow an attacker to execute arbitrary code. PHP is prone to a heap-based buffer-overflow vulnerability because the application fails…

Background: There are six major modules in harbor. The default components of each harbor are packaged into a docker container, so the harbor can be deployed via compose, which is divided into 8 containers and run through docker-compose ps. Vulnerability details: A vulnerability in the POST /api/users API of Harbor may allow for a remote…

Preface: a motion control system includes at least three basic components — a motor, a drive, and a controller. Second, motion control systems are primarily used in discrete industries such as packaging and semiconductor manufacturing, as opposed to process industries such as chemical manufacturing and power generation. Product background: Siemens SIMATIC TDC provides the highest…

Security focus – CVE-2019-1367: Microsoft conducted remedy for CVE-2018-8653, but a item not being fixed. Suspected that this is one of the reason let Microsoft Releases Out-of-Band Security Updates on 23th Sep 2019. Should you have interested of this matter, please refer to attached diagram. The official announcement can be found at: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1367 Apart from…

Preface: Do you think that VPN solutions will reduce the level of network security risks? Background: On 10th Sep, 2019, Siemens announce that a multiple vulnerabilities in SINEMA connect server. Our attention this time will be focused CVE-2019-13920 and CVE-2019-13922. Refer to attached diagram, the fundamental design of SINEMA and network switch can form VPN…

Preface: The SD-WAN is a specific application of software-defined networking (SDN) technology applied to WAN connections such as broadband internet, 4G, LTE, or MPLS.The technology deployment consists of QoS and network resiliance. Product background: EdgeConnect has following features: Extend the micro-segmentation of specific application traffic from the data center to the entire WAN to help…

Preface: In 1894 Damoizeau developed a panoramic stereoscopic camera with twin-lenses, twin-spools and twin -slits. Background information: With 3D graphics configured for RDS hosts, both applications in application pools and applications running on RDS desktops can display 3D graphics. Vulnerability details: This vulnerability can be triggered by providing a tamper-evident pixel shader to the AMD…

Introduction: Open Virtualization Format. Open Virtualization Format (OVF) is an open standard for packaging and distributing virtual appliances or, more generally, software to be run in virtual machine. Synopsis: Open Virtualization Format provides the ability to let a virtual appliance and run it on different vendors of virtual machine. For example: Vmware.Two of the vulnerabilities,…

What is HHVM? HHVM is an open-source virtual machine designed for executing programs written in Hack and PHP. The mechanism is convert PHP to bytecode. Then, bytecode translated to machine code at runtime by JIT (just-in-time) compiler. Vulnerability details: CVE-2019-11925 and CVE2019-11926 found design weakness of the boundary check when processing JPEG APP12 block marker…