SSD安全公告-希捷个人云存储设备多个漏洞

Credit to Author: SSD / Maor Schwartz| Date: Mon, 22 Jan 2018 12:07:17 +0000

漏洞概要 以下安全公告描述两个未经身份验证的命令注入漏洞。 希捷个人云家庭媒体存储设备是“存储,整理,流式传输,共享所有音乐,电影,照片和重要文档的最简单的方式”。 漏洞提交者 一位独立的安全研究人员Yorick Koster向 Beyond Security 的 SSD 报告了该漏洞。 厂商响应 希捷在10月16日被告知该漏洞,虽然已确认收到漏洞信息,但拒绝回应(我们给出的)技术细节,也没有给出确定的修复时间或是协调报告。 CVE:CVE-2018-5347 漏洞详细信息 Seagate Media Server使用Django Web框架并映射到.psp扩展名。 任何以.psp结尾的URL都会使用FastCGI协议自动发送到Seagate Media Server应用程序。 /etc/lighttpd/conf.d/django-host.conf: [crayon-5a666358f0897494367467/] URL被映射到文件/usr/lib/django_host/seagate_media_server/urls.py中特定的views。 有两个views受到未经认证的命令注入漏洞的影响。 受影响的views是: uploadTelemetry getLogs 这些views从GET参数获取用户输入,并将这些未经验证/解析的参数传递给Python模块相应的函数。 这允许攻击者注入任意的系统命令,这些命令将以root权限执行。 /usr/lib/django_host/seagate_media_server/views.py: [crayon-5a666358f08a3012049689/] /usr/lib/django_host/seagate_media_server/views.py: [crayon-5a666358f08a8093835846/] 请注意,这两个views都包含csrf_exempt decorator,它会禁用Django的默认开启的CSRF保护。 因此,这些问题可以通过跨站请求伪造来进行利用。 漏洞证明 下面的漏洞验证代码将尝试启用SSH服务,并更改root密码。 如果成功,则可以使用新密码通过SSH登录设备。 [crayon-5a666358f08ae242951493/]

Read more

SSD安全公告-Sophos XG从未经身份验证的存储型XSS漏洞到Root访问

Credit to Author: SSD / Maor Schwartz| Date: Mon, 22 Jan 2018 11:52:38 +0000

漏洞概要 以下安全公告描述了在Sophos XG 17中发现的一个存储型XSS漏洞,成功利用该漏洞可以获取root访问。 Sophos XG防火墙“全新的控制中心为用户的网络提供前所未有的可视性。可以获得丰富的报告,还可以添加Sophos iView,以便跨多个防火墙进行集中报告。“ 漏洞提交者 一位独立的安全研究人员向 Beyond Security 的 SSD 报告了该漏洞 厂商响应 Sophos已被告知这个漏洞,他们的回应是: 12月11日,我们收到并确认您提交的问题 12月12日,我们确认了这个问题,并开始进行修复 12月20日,我们发布了XGv17 MR3的官方修复:https:https://community.sophos.com/products/xg-firewall/b/xg-blog/posts/sfos-17-0-3-mr3-released 12月29日,我们完成了对之前发布的XGv16,v16.5,v17版本的修复 12月31日,我们根据您的要求发布了我们的安全公告:https://community.sophos.com/kb/en-us/128024?elqTrackId=3a6db4656f654d65b352f526d26c6a17&elq=1514ab02d2764e8cb73e6b0bdbe7e7be&elqaid=2739&elqat=1&elqCampaignId=27053 CVE:CVE-2017-18014 漏洞详细信息 未经身份验证的用户可以在webadmin界面中的WAF日志页面(控制中心 – >日志浏览器 – >,在过滤器选项“Web服务器保护”中)中触发存储型XSS漏洞,该漏洞可执行防火墙webadmin 可以执行的任何动作(创建新的用户/ 启用ssh和添加ssh授权密钥等)。 为了触发这个漏洞,我们将演示以下场景: Sophos XG Firewall配置3个区域:Trusted,Untrusted,DMZ WEB服务器被放置在DMZ中 防火墙使用Sophos推荐的默认Web应用防火墙(WAF)保护Web服务器。 来自Untrusted网络的攻击者向DMZ中的Web服务器发送URL请求,造成到脚本注入WAF日志页面 来自Trusted的管理员访问WAF日志页面 没有任何其他交互或警告,脚本向管理用户添加一个SSH授权密钥,并允许来自Untrusted的ssh管理。 攻击者获得完整的root ssh shell Sophos XG WAF日志页面将执行POST请求中“User-Agent”参数。 漏洞证明 Sophos XG配置: 防火墙接口可信 – 192.168.10.190端口A. 防火墙接口不可信 – 192.168.0.192端口B. … Continue reading SSD安全公告-Sophos XG从未经身份验证的存储型XSS漏洞到Root访问

Read more

SSD Advisory – Hack2Win – Asus Unauthenticated LAN Remote Command Execution

Credit to Author: SSD / Maor Schwartz| Date: Mon, 22 Jan 2018 11:50:36 +0000

Vulnerabilities Summary The following advisory describes two (2) vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE POWERFUL USER-FRIENDLY INTERFACE – The enhanced ASUSWRT graphical user interface gives you easy access to the 30-second, 3-step web-based installation process. It’s also … Continue reading SSD Advisory – Hack2Win – Asus Unauthenticated LAN Remote Command Execution

Read more

Hack2Win eXtreme

Credit to Author: SSD / Maor Schwartz| Date: Mon, 22 Jan 2018 08:40:05 +0000

Hack2Win is a hacking competition we launched 5 years ago. The competition had so far two flavors – Hack2Win Online and Hack2Win CodeBlue. We decided to go big this year and with Hack2Win eXtreme! Hack2Win eXtreme will focus on two primary targets, browsers and mobile. We have up to $500,000 USD to give away! The … Continue reading Hack2Win eXtreme

Read more

Get 29% Off This 6-Sheet Micro-Cut Paper and Credit Card Shredder

Credit to Author: DealPost Team| Date: Mon, 22 Jan 2018 07:08:00 -0800

This powerful micro-cut shredder from AmazonBasics turns a letter-sized sheet into 2,235 pieces of confetti, up to 6 sheets at a time (5/32 by 15/32 inches; security level P-4). Inserted one at a time, it also destroys credit cards, rendering them completely unusable. It features a generous 4.1-gallon waste bin that is easy to manage. This micro-cut shredder averages 4.5 out of 5 stars on Amazon from over 1,900 people (72% rate a full 5 stars: read reviews). Its typical list price of $50 has been reduced 29% to $36. See it on Amazon.

To read this article in full, please click here

Read more

FAQ: Windows 10 LTSB explained

Credit to Author: Gregg Keizer| Date: Mon, 22 Jan 2018 03:52:00 -0800

Windows 10 will power to its third anniversary this summer, but one branch, identified by the initials L-T-S-B, remains an enigma to most corporate users.

LTSB, which stands for “Long-term Servicing Branch,” was among the pillars of Windows 10 in the months leading up to, and for months after, the mid-2015 roll-out of the operating system. For a time, it seemed that it had a shot at becoming the Windows 10 for enterprise because it was seen as a calm port in a storm of radical change.

That hasn’t happened, in part because Microsoft has steered customers away from LTSB.

Just what is LTSB? And what has Microsoft done to make it an afterthought?

To read this article in full, please click here

Read more

Patching meltdown: Windows fixes, sloppy .NET, warnings about Word and Outlook

Credit to Author: Woody Leonhard| Date: Fri, 19 Jan 2018 09:28:00 -0800

On the heels of the Jan. 17 release of 14 Windows and .NET patches, we now have a huge crop of new patches, revised older patches, warnings about bugs, and a bewildered ecosystem of Microsoft customers who can’t figure out what in the blue blazes is going on.

Let’s step through the, uh, offerings on Jan. 18.

Windows 10 patches

Win10 Fall Creators Update version 1709 — Cumulative update KB 4073291 brings the Meltdown/Spectre patches to 32-bit machines. What, you thought 32-bit machines already had Meltdown/Spectre patches? Silly mortal. Microsoft’s Security Advisory ADV180002 has the dirty details in the fine print, point 7:

To read this article in full, please click here

Read more

Mozilla mandates that new Firefox features rely on encrypted connections

Credit to Author: Gregg Keizer| Date: Thu, 18 Jan 2018 10:37:00 -0800

Mozilla this week decreed that future web-facing features of Firefox must meet an under-development standard that requires all browser-to-server-and-back traffic be encrypted.

“Effective immediately, all new features that are web-exposed are to be restricted to secure contexts,” wrote Mozilla engineer Anne van Kesteren in a post to a company blog. “A feature can be anything from an extension of an existing IDL-defined object, a new CSS property, a new HTTP response header, to bigger features such as WebVR.”

Secure contexts, dubbed a “minimum security level,” is a pending standard of the W3 (World Wide Web Consortium), the primary standards body for the web. Secure contexts’ main purpose, according to its documentation: “Application code with access to sensitive or private data be delivered confidentially over authenticated channels that guarantee data integrity.”

To read this article in full, please click here

Read more

More Windows patches, primarily previews, point to escalating problems this month

Credit to Author: Woody Leonhard| Date: Thu, 18 Jan 2018 06:39:00 -0800

Never give a sucker an even break. Yesterday, on a very out-of-band Wednesday, Microsoft released preview patches for Windows 8.1 (but not 7!), Server 2012, and Windows 10 1709 (for bricked AMD machines only), with preview cumulative updates for Win10 1703 and 1607. There are also nine different .NET preview patches.

What should you do? Nothing. More accurately, make sure you DON’T install any of them. Fortunately, all of these patches require that you download and install them — and you’d have to be crazy (or an admin trying to shore up some critical servers) to dive into the cesspool.

It’s the same advice I’ve been giving all month. There’s nothing here that you need right now — there are no known exploits for Meltdown or Spectre in the wild, in particular — and machines are dropping like flies.

To read this article in full, please click here

Read more

Throwback Thursday: What are the odds?

Credit to Author: Sharky| Date: Thu, 18 Jan 2018 03:00:00 -0800

Internet filter is installed at this site, and in the beginning, there are complaints from users who can’t get to their favorite non-business sites, says an IT pilot fish working there.

But after six months and lots of explanations to users, the complaints have stopped. “Then one Saturday evening, a user called me,” fish says.

“He called to report that something must be wrong, because he could get to his lottery numbers tonight.

“I told him thanks, and that I would inform the individual in charge of the filter on Monday morning, as it wasn’t stopping anything production-critical during the weekend hours.

“I still can’t decide which is funnier: the fact that apparently every day for nearly six months this user tried to get to his lottery numbers even though the page should have never loaded again — or that, when he actually was able to, he reported it as a problem.”

To read this article in full, please click here

Read more