-
Do not contempt CVE-2019-11932 attack. It can jeopardize the Android software applications world!
Preface: CVE record summarized by human. Perhaps sometimes might have typo! Vulnerability description: A double free vulnerability in the DDGifSlurp function in decoding.c in libpl_droidsonroids_gif before 1.2.15, as used in WhatsApp for Android before 2.19.244, allows remote attackers to execute arbitrary code or cause a denial of service. However CVE-2019-11932 is a vulnerability in the…
-
How we focus design weakness?
Preface: Flaws that require root access are not considered security issues in existing policy. If we are not using cloud computing concept. It is acceptable. But we need cloud system! Security focus: Turkish information security specialist found a design weakness in Windows kernel design. According to the vendor’s Bug Bounty program rules, flaws that require…
-
Outlook for Android – DOM based cross-site scripting (XSS) vulnerability (Nov 2019)
Preface: XSS attack can be either server-side or client-side. Vulnerability details: A vulnerability occurs on Outlook for Android that would allow an attacker to perform cross-site scripting (XSS) attacks on the affected systems and run scripts in the security context of the current user. The official announcement did not described in details. So my earlier…
-
TCP-pipelined queries flaw, causes to bypass tcp-clients limit (CVE-2019-6477)
Preface: To improve bandwidth utilization, an introduce of layer-4 relay(s) that enable the pipelining of TCP connections. Background: BIND 9 has evolved to be a very flexible, full-featured DNS system. On a server with TCP-pipelining capability,it is possible for one TCP client to send a large number of DNS requests over a single connection. Vulnerability…
-
looking back the malware evolutionary at 2019
Preface: Unlike C, C++ is an object-oriented programming language, following a programming model that uses objects that contain data as well as functions to manipulate the data. Word is an object-oriented program. Security focus: The malware author usually exploit some kind of arbitrary code execution or zero day. And therefore it have chances to evade…
-
Gun and bullet – SMBV1 and Ransomware (Nov 2019)
Preface: Starting from around 2012 the use of ransomware scams has grown internationally. Background: About 5 days ago, headline news of Bloomberg told that cyber criminals compromised the IT infrastructure for Mexican Petroleum. Meanwhile, hacker hopes to extract nearly $5 million from the company, with a final deadline of 30th November, 2019. Tremendous incident record:…
-
Interested in this vulnerability CVE-2019-5541?
Preface: As far as I know, VMware announced CVE-2019-5541 on April 2019. But the security update just released two days ago. Perhaps this products not in profitable area. But the flaw awaken quite a lot of people to concerning the weakness in virtual machine design. Background: VMware Workstation is for Windows/Linux while Fusion is for…
-
CVE-2019-0721, CVE-2019-1397, CVE-2019-1398, CVE-2019-1399 – Hyper-V Remote Code Execution Vulnerabilities
Preface: Virtualization in the virtualization platform. It is definitely a microsystem architecture. Technical background: Windows Sandbox requires a Type 1 hypervisor. Therefore, to run Sandbox on a virtual machine, nested virtualization must be enabled. Nested virtualization allows running Hyper-V on a virtual machine. In addition, it allows Windows Sandbox to run on a virtual machine.…
-
The arbitrary code execution (ACE) is on your wrist CVE-2019-8718
Preface: XNU is an operating system kernel developed by Apple Computer for the macOS operating system. It is part of the Darwin operating system. XNU is a hybrid kernel combining the Mach kernel . Background: IOKit – Gain user-space access to hardware devices and drivers. The IOKit object representing a hub device on the USB…
-
Nov 2019 – malware samples, staying alert!
Preface: The Trojan mostly arrive via email or spread from infected websites that users visit. Background: U.S. Cyber Command has released seven malware samples. The malware hash shown as below: a2a77cefd2faa17e18843d74a8ad155a061a13da9bd548ded6437ef855c14442 fdb87add07d3459c43cfa88744656f6c00effa6b7ec92cb7c8b911d233aeb4ac 738ba44188a93de6b5ca7e0bf0a77f66f677a0dda2b2e9ef4b91b1c8257da790 04d70bb249206a006f83db39bbe49ff6e520ea329e5fbb9c758d426b1c8dec30 618a67048d0a9217317c1d1790ad5f6b044eaa58a433bd46ec2fb9f9ff563dc6 1ea6b3e99bbb67719c56ad07f5a12501855068a4a866f92db8dcdefaffa48a39 b6811b42023524e691b517d19d0321f890f91f35ebbdf1c12cbb92cda5b6de32 Our observation: VC++ method of injecting code into other programs is popular (see below): Put your code into…