Tag: execute

iOS 透過無線網路的 RCE...

在「About the security content of iOS 10.3.1」這邊的說明：

Available for: iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation and later
Impact: An attacker within range may be able to execute arbitrary code on the Wi-Fi chip
Description: A stack buffer overflow was addressed through improved input validation.
CVE-2017-6975: Gal Beniamini of Google Project Zero

這描述看起來就不太妙...

Bash 遠端執行安全漏洞

這讓人無言了，Bash 的遠端執行安全漏洞，CVE-2014-6271：

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.

可以在 oss-sec 上面看到說明「Re: CVE-2014-6271: remote code execution through bash」：

Debian and other GNU/Linux vendors plan to disclose a critical, remotely exploitable security vulnerability in bash this week, related to the processing of environment variables. Stephane Chazelas discovered it, and CVE-2014-6271 has been assigned to it.

透過環境變數打進去... Redhat 的「Bash specially-crafted environment variables code injection attack」這篇也給了不少例子。

Linux 下通常最常用的 shell 應該還是 Bash 吧？(雖然也看到不少人用 Zsh...)

然後 Twitter 上看到非常邪惡的 Google Hack：

大家可以自己加上 site: 去掃...

微軟的 IE6+ 安全性更新

即使 Windows XP 在上個月就已經停止安全性更新，但這次的 CVE-2014-1776 影響層面還是太廣，微軟還是提供 Windows XP 用戶相關的 patch (透過 Windows Update 發送)：

Use-after-free vulnerability in VGX.DLL in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2014.

在「Security Update Released to Address Recent Internet Explorer Vulnerability」也可以看到說明。

看到 use-after-free 這個詞就想到 OpenSSL 前陣子也來一發 CVE-2010-5298 (居然是 2010 年的 CVE)，讓人... XD