Tag Archives: cve

最近 OpenVPN 的安全性漏洞...

Posted on June 28, 2017 by Gea-Suan Lin

看到「The OpenVPN post-audit bug bonanza」這個只有苦笑啊... 作者在 OpenVPN 經過一連串的安全加強後 (包括 harden 計畫與兩個外部單位的程式碼稽核找到不少問題)，決定出手挖看看： After a hardening of the OpenVPN code (as commissioned by the Dutch intelligence service AIVD) and two recent audits 1 2, I thought it was now time for some … Continue reading →

Posted in Computer, Murmuring, Network, Security, Software, VPN | Tagged , , , , , , , , , , , , , , | Leave a comment

iOS 透過無線網路的 RCE...

Posted on April 4, 2017 by Gea-Suan Lin

在「About the security content of iOS 10.3.1」這邊的說明： Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip … Continue reading →

Posted in Computer, Hardware, Murmuring, Network, Security, Software | Tagged , , , , , , , , , , , , , , , , , , , | Leave a comment

分析現在還有多少不安全的 JavaScript Library 被使用

Posted on March 11, 2017 by Gea-Suan Lin

在「Thou shalt not depend on me: analysing the use of outdated JavaScript libraries on the web」這邊看到對 JavaScript Library 的研究。 jQuery 沒有什麼疑問的還是最大宗，查了一下應該是 CVE-2011-4969 的影響，對 jQuery 1.6、1.6.1、1.6.2 三個版本有影響。 另外也提到了 hosting 的部份，可以看到 Google Hosted Libraries 還是佔有最高的比率。

Posted in CDN, Cloud, Computer, Murmuring, Network, Programming, Security, Software | Tagged , , , , , , , | Leave a comment

cURL 接下來的安全性更新...

Posted on October 22, 2016 by Gea-Suan Lin

cURL 的維護老大放話要大家注意接下來的安全性更新：「An alert on the upcoming 7.51.0 release」。 最少 11 個安全性更新： This release will bundle no less than _eleven_ security advisories and their associated fixes (unless we get more reported in the time we have left). 由於這些 security issue 的特性，會採取不公開的 … Continue reading →

Posted in Computer, Murmuring, Network, Security, Software | Tagged , , , , , , , , | Leave a comment

Cisco 與 Fortinet 防火牆的 RCE 漏洞

Posted on August 20, 2016 by Gea-Suan Lin

NSA 使用這些漏洞來大量監聽企業的流量：「Leaked Exploits are Legit and Belong to NSA: Cisco, Fortinet and Snowden Docs Confirm」。 Cisco 已經確認這個安全性漏洞了，全系列包括已經停產的 Cisco PIX、上個世代的 Cisco ASA 5500 (但還有些型號還在賣)，以及目前主力的 Cisco ASA 5500-X，另外還包括了安全模組系列也中獎：「Cisco Adaptive Security Appliance SNMP Remote Code Execution Vulnerability」。 Cisco ASA 5500 Series Adaptive Security … Continue reading →

Posted in Computer, Hardware, Murmuring, Network, Political, Security, Social, VPN, WWW | Tagged , , , , , , , , , , , , , , , , | Leave a comment

Libgcrypt 與 GnuPG 的安全性問題

Posted on August 20, 2016 by Gea-Suan Lin

在「Security fixes for Libgcrypt and GnuPG 1.4 [CVE-2016-6316]」這邊看到這個歷史悠久的 bug： Felix Dörre and Vladimir Klebanov from the Karlsruhe Institute of Technology found a bug in the mixing functions of Libgcrypt's random number generator: An attacker who obtains 4640 bits from the … Continue reading →

Posted in Computer, Murmuring, Security, Software | Tagged , , , , , , , , , , , | Leave a comment

OpenSSL 的 DSA 被 Side-channel attack 打爆

Posted on June 16, 2016 by Gea-Suan Lin

在「Make Sure DSA Signing Exponentiations Really are Constant-Time」這篇文章裡面，直接透過 end-to-end 的 timing attack 打爆 (也就是透過 internet 觀察攻擊)，而不需要在同一台機器上對 cache 之類的區域攻擊： A unique feature of our work is that we target common cryptographic protocols. Previous works that demonstrate cache-timing key-recovery attack only target … Continue reading →

Posted in Computer, Murmuring, Network, Security, Software | Tagged , , , , , , , , , , , , , | Leave a comment

最近的兩個安全性漏洞：OpenSSL、ImageMagick

Posted on May 4, 2016 by Gea-Suan Lin

OpenSSL 的安全性漏洞公告：「OpenSSL Security Advisory [3rd May 2016]」。ImageMagick 的安全性漏洞說明頁：「ImageTragick」。 CVE-2016-2107 是修 Lucky 13 問題時沒修好造成的： This issue was introduced as part of the fix for Lucky 13 padding attack (CVE-2013-0169). The padding check was rewritten to be in constant time by making … Continue reading →

Posted in Computer, Murmuring, Security, Software | Tagged , , , | Leave a comment

Git 的安全性問題

Posted on March 17, 2016 by Gea-Suan Lin

在「Remote Code Execution in all git versions (client + server) < 2.7.1: CVE-2016-2324, CVE-2016‑2315」這邊看到歡樂的 CVE-2016-2315 與 CVE-2016-2324，屬於 RCE 類漏洞。 Git 2.7.1 之前的所有版本都有問題，看起來由於問題過於大條，在 2016/02/06 發表的「Git v2.7.1 Release Notes」沒有標出這兩個 CVE，讓所有 vendor 有時間升級。 不過看起來 GitLab 不在被通知的 vendor 裡面，很無奈的在 CVE 公開後馬上推出新版，需要升級到最新版本：「GitLab 8.5.7 Released」。

Posted in Computer, Murmuring, Programming, Security, Software | Tagged , , , , , , , | 3 Comments

CVE-2015-7547：getaddrinfo() 的 RCE (Remote Code Execution) 慘案

Posted on February 17, 2016 by Gea-Suan Lin

Google 寫了一篇關於 CVE-2015-7547 的安全性問題：「CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow」。 Google 的工程師在找 OpenSSH 連到某台特定主機就會 segfault 的通靈過程中，發現問題不在 OpenSSH，而是在更底層的 glibc 導致 segfault： Recently a Google engineer noticed that their SSH client segfaulted every time they tried to connect to a specific host. That … Continue reading →

Posted in Computer, DNS, Linux, Murmuring, Network, OS, Security, Software | Tagged , , , , , , , , , , , , , , , , , , , , | Leave a comment