SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure

Vulnerability Summary The following advisory describes an information disclosure found in the following TrendNet routers: TEW-751DR – v1.03B03 TEW-752DRU – v1.03B01 TEW733GR – v1.03B01 TRENDnet’s “N600 Dual Band Wireless Router, model TEW-751DR, offers proven concurrent Dual Band 300 Mbps Wireless N networking. Embedded GREENnet technology reduces power consumption by up to 50%. For your convenience … Continue reading SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure

The post SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure appeared first on Security Boulevard.

from SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure

SSD Advisory – Hack2Win – Cisco RV132W Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes two (2) vulnerabilities found in Cisco RV132W Wireless N VPN version 1.0.1.8 The Cisco RV132W Wireless-N ADSL2+ VPN Router is “easy to use, set up, and deploy. This flexible router offers great performance and is suited for small or home offices (SOHO) and smaller deployments.” The vulnerabilities found are: … Continue reading SSD Advisory – Hack2Win – Cisco RV132W Multiple Vulnerabilities

The post SSD Advisory – Hack2Win – Cisco RV132W Multiple Vulnerabilities appeared first on Security Boulevard.

from SSD Advisory – Hack2Win – Cisco RV132W Multiple Vulnerabilities

SSD Advisory – Python Bytecode Disassembler and Decompiler (pycdc) Multiple Vulnerabilities

Vulnerabilities summary The following advisory describes 12 (twelve) vulnerabilities found in Python Bytecode Disassembler and Decompiler (pycdc). Python Bytecode Disassembler and Decompiler (pycdc) “aims to translate compiled Python byte-code back into valid and human-readable Python source code. While other projects have achieved this with varied success, Decompyle++ is unique in that it seeks to support … Continue reading SSD Advisory – Python Bytecode Disassembler and Decompiler (pycdc) Multiple Vulnerabilities

The post SSD Advisory – Python Bytecode Disassembler and Decompiler (pycdc) Multiple Vulnerabilities appeared first on Security Boulevard.

from SSD Advisory – Python Bytecode Disassembler and Decompiler (pycdc) Multiple Vulnerabilities

SSD Advisory – iBall Multiple Vulnerabilities

Vulnerabilities summary The following advisory describes two (2) vulnerabilities found in iB-WRA150N devices, firmware 1.2.6 build 110401 Rel.47776n. iB-WRA150N is “a powerful solution to Internet connectivity at home, small offices and work stations. The key is if you are using an ADSL2+ connection now and later decide to change to Broadband or vice-versa you don’t … Continue reading SSD Advisory – iBall Multiple Vulnerabilities

The post SSD Advisory – iBall Multiple Vulnerabilities appeared first on Security Boulevard.

from SSD Advisory – iBall Multiple Vulnerabilities

SSD Advisory – Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities

Vulnerabilities summary The following advisory describes two (2) guest to host escape found in Oracle VirtualBox version 5.1.30, and VirtualBox version 5.2-rc1. Credit An independent security researcher, Niklas Baumstark, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program. Vendor response Oracle were informed of the vulnerabilities and released patches to address them. For … Continue reading SSD Advisory – Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities

The post SSD Advisory – Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities appeared first on Security Boulevard.

from SSD Advisory – Oracle VirtualBox Multiple Guest to Host Escape Vulnerabilities

SSD Advisory – Hack2Win – Asus Unauthenticated LAN Remote Command Execution

Vulnerabilities Summary The following advisory describes two (2) vulnerabilities found in AsusWRT Version 3.0.0.4.380.7743. The combination of the vulnerabilities leads to LAN remote command execution on any Asus router. AsusWRT is “THE POWERFUL USER-FRIENDLY INTERFACE – The enhanced ASUSWRT graphical user interface gives you easy access to the 30-second, 3-step web-based installation process. It’s also … Continue reading SSD Advisory – Hack2Win – Asus Unauthenticated LAN Remote Command Execution

The post SSD Advisory – Hack2Win – Asus Unauthenticated LAN Remote Command Execution appeared first on Security Boulevard.

from SSD Advisory – Hack2Win – Asus Unauthenticated LAN Remote Command Execution

Hack2Win eXtreme

Hack2Win is a hacking competition we launched 5 years ago. The competition had so far two flavors – Hack2Win Online and Hack2Win CodeBlue. We decided to go big this year and with Hack2Win eXtreme! Hack2Win eXtreme will focus on two primary targets, browsers and mobile. We have up to $500,000 USD to give away! The … Continue reading Hack2Win eXtreme

The post Hack2Win eXtreme appeared first on Security Boulevard.

from Hack2Win eXtreme

SSD Advisory – GitStack Unauthenticated Remote Code Execution

Vulnerability Summary The following advisory describes an unauthenticated action that allows a remote attacker to add a user to GitStack and then used to trigger an unauthenticated remote code execution. GitStack is “a software that lets you setup your own private Git server for Windows. This means that you create a leading edge versioning system … Continue reading SSD Advisory – GitStack Unauthenticated Remote Code Execution

The post SSD Advisory – GitStack Unauthenticated Remote Code Execution appeared first on Security Boulevard.

from SSD Advisory – GitStack Unauthenticated Remote Code Execution

SSD Advisory – Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access

Vulnerability Summary The following advisory describes an unauthenticated persistent XSS that leads to unauthorized root access found in Sophos XG version 17. Sophos XG Firewall “provides unprecedented visibility into your network, users, and applications directly from the all-new control center. You also get rich on-box reporting and the option to add Sophos iView for centralized … Continue reading SSD Advisory – Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access

The post SSD Advisory – Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access appeared first on Security Boulevard.

from SSD Advisory – Sophos XG from Unauthenticated Persistent XSS to Unauthorized Root Access

SSD Advisory–D-Link DSL-6850U多个漏洞

漏洞概要 以下安全公告描述了在D-Link DSL-6850U BZ_1.00.01 – BZ_1.00.09中的发现的两个漏洞。 D-Link DSL-6850U是一款“以色列Bezeq制造的路由器”，在这款路由器中发现的漏洞是： 默认凭证 远程命令执行 漏洞提交者 一位独立的安全研究人员向 Beyond Security 的 SSD 报告了该漏洞 厂商响应 Bezeq在6月9日被告知了这个漏洞，并且发布了补丁来解决这些漏洞。 漏洞详细信息 该设备定制的固件存在以下问题： 默认启用远程Web管理 不能禁用默认帐户 默认凭证 默认帐户用户名是：support 密码是：support 远程命令执行 shell界面只允许执行一组内置命令，但是你可以通过’＆’ ‘||’ 插入命令到shell： [crayon-5a51d2a1dcf1e856369540/] 上述命令执行后返回一个BusyBox shell

The post SSD Advisory–D-Link DSL-6850U多个漏洞 appeared first on Security Boulevard.

from SSD Advisory–D-Link DSL-6850U多个漏洞

SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes four (4) vulnerabilities found in Livebox Fibra router version AR_LBFIBRA\_sp-00.03.04.112S. It is possible to chain the vulnerabilities into remote code execution. The “Livebox Fibra” router is “manufactured by Arcadyan for Orange and Jazztel in Spain” The vulnerabilities found in Arcadyan routers are: Unauthenticated configuration information leak Hard-coded credentials Memory … Continue reading SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities

The post SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities appeared first on Security Boulevard.

from SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities

SSD Advisory – D-Link DSL-6850U Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes two (2) vulnerabilities found in D-Link DSL-6850U versions BZ_1.00.01 – BZ_1.00.09. D-Link DSL-6850U is a router “manufactured by D-Link for Bezeq in Israel” The vulnerabilities found are: Default Credentials Remote Command Execution Credit An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program. Vendor … Continue reading SSD Advisory – D-Link DSL-6850U Multiple Vulnerabilities

The post SSD Advisory – D-Link DSL-6850U Multiple Vulnerabilities appeared first on Security Boulevard.

from SSD Advisory – D-Link DSL-6850U Multiple Vulnerabilities

SSD安全公告-vBulletin routestring未经验证的远程代码执行

漏洞概要 以下安全公告描述了在vBulletin5中发现的一个未经身份验证的文件包含漏洞，成功利用该漏洞可造成远程代码执行。 vBulletin也称为vB，由vBulletin Solutions公司基于PHP和MySQL开发，广泛用于搭建网络论坛。 vBulletin为许多网络大型的社交网站提供技术支持，数量超过10万，其中包括财富500强和Alexa Top 1M公司的网站和论坛。根据最新的W3Techs1统计，vBulletin 4拥有超过55％的vBulletin市场份额，而vBulletin 3和vBulletin 5则占剩下的45％。 漏洞提交者 一位独立的安全研究人员向 Beyond Security 的 SSD 报告了该漏洞 厂商响应 自2017年11月21日起，我们多次尝试联系vBulletin，但是暂时没有得到回复。目前，漏洞暂时还没有解决方案。 漏洞详细信息 vBulletin存在一个漏洞，导致远程攻击者可以从vBulletin服务器中包含任意文件并执行PHP代码。 未经身份验证的用户可以向/index.php发送GET请求，然后使用参数routestring =触发文件包含漏洞。 该请求允许攻击者向安装在Windows操作系统上的Vbulletin服务器创建精心制作的请求，并在Web服务器上包含任意文件。 /index.php 部分代码： [crayon-5a48956e976e8499982937/] 让我们仔细看看vB5_Frontend_Application :: init — /includes/vb5/frontend/application.php部分代码： [crayon-5a48956e976ef699978057/] 我们可以看到setRoutes()被调用 /includes/vb5/frontend/routing.php部分代码： [crayon-5a48956e976f2300464943/] 因此，如果我们的字符串不以’.gif，‘.png’，’.jpg’，’.css’或者‘.js’结尾并且不包含’/’字符，vBulletin会从vB5_Frontend_Controller_Relay中调用legacy() /includes/vb5/frontend/controller/relay.php部分代码： [crayon-5a48956e976fa261434075/] 如果我们从Api_Interface_Collapsed类中检查relay() /include/api/interface/collapsed.php部分代码： [crayon-5a48956e976fd577420656/] 正如我们所看到的，攻击者无法在$文件中使用“/”，所以不能在Linux上更改当前目录。但是对于Windows而言，可以使用’\’作为路径分隔符，通过PHP包含任意所需的文件（也可以使用’\ .. \’技巧）。 如果我们想包含扩展名为’.gif’，’.png’，’.jpg’，’.css’或’.js’这样的文件，需要绕过setRoutes（）方法里面的过滤，绕过很容易，可以通过添加点（’.’）或空格（’%20’）到文件名来绕过。 完整的漏洞证明 我们可以通过发送下面的GET请求来检查服务器是否有漏洞： /index.php?routestring=.\\ 如果回显是： 那么服务器存在漏洞 如果我们想要在服务器上的任何文件中注入一个php代码，我们可以使用access.log例如： /?LogINJ_START=LogINJ_END … Continue reading SSD安全公告-vBulletin routestring未经验证的远程代码执行

The post SSD安全公告-vBulletin routestring未经验证的远程代码执行 appeared first on Security Boulevard.

from SSD安全公告-vBulletin routestring未经验证的远程代码执行

SSD Advisory – Kingsoft Antivirus/Internet Security 9+ Privilege Escalation

Vulnerability Summary The following advisory describes a kernel stack buffer overflow that leads to privilege escalation found in Kingsoft Antivirus/Internet Security 9+. Kingsoft Antivirus “provides effective and efficient protection solution at no cost to users. It applies cloud security technology to monitor, scan and protect your systems without any worrying. The comprehensive defender and anti-virus … Continue reading SSD Advisory – Kingsoft Antivirus/Internet Security 9+ Privilege Escalation

The post SSD Advisory – Kingsoft Antivirus/Internet Security 9+ Privilege Escalation appeared first on Security Boulevard.

from SSD Advisory – Kingsoft Antivirus/Internet Security 9+ Privilege Escalation

SSD Advisory – Trustwave SWG Unauthorized Access

Vulnerability Summary The following advisory describes an unauthorized access vulnerability that allows an unauthenticated user to add their own SSH key to a remote Trustwave SWG version 11.8.0.27. Trustwave Secure Web Gateway (SWG) “provides distributed enterprises effective real-time protection against dynamic new malware, strong policy enforcement, and a unique Zero-Malware Guarantee when managed for you … Continue reading SSD Advisory – Trustwave SWG Unauthorized Access

The post SSD Advisory – Trustwave SWG Unauthorized Access appeared first on Security Boulevard.

from SSD Advisory – Trustwave SWG Unauthorized Access

SSD Advisory – Huawei P8 wkupccpu debugfs Kernel Buffer Overflow

Vulnerability Summary The following advisory describes a buffer overflow found in Huawei P8 Lite ALE-21 HI621sft, operating system versions EMUI 3.1 – wkupccpu debugfs driver. Huawei Technologies Co. Ltd. is “a multinational networking and telecommunications equipment and services company, it is the largest telecommunications equipment manufacturer in the world and the second largest smartphone manufacturer … Continue reading SSD Advisory – Huawei P8 wkupccpu debugfs Kernel Buffer Overflow

The post SSD Advisory – Huawei P8 wkupccpu debugfs Kernel Buffer Overflow appeared first on Security Boulevard.

from SSD Advisory – Huawei P8 wkupccpu debugfs Kernel Buffer Overflow

SSD安全公告-Linux内核XFRM权限提升漏洞

漏洞概要 以下安全公告描述了在Linux内核中发现的一个UAF漏洞，成功利用此漏洞的攻击者可以提升权限。漏洞存在于Netlink 套接字子系统 – XFRM. Netlink用于在内核和用户空间进程之间传输信息。 它由用户空间进程的标准基于套接字的接口和内核模块的内部内核API组成。 漏洞提交者 一位独立的安全研究员Mohamed Ghannam向Beyond Security的SSD报告了该漏洞 厂商响应 该漏洞已在补丁1137b5e中被修复（“ipsec：修复中止xfrm策略转储崩溃”） CVE: CVE-2017-16939 [crayon-5a2e498b90407277832096/] 漏洞详细信息 非特权用户可以更改Netlink 套接字子系统 XFRM sk-> sk_rcvbuf的值（sk ==sock结构体对象）。 可以通过setsockopt（SO_RCVBUF）更改sk-> sk_rcvbuf的值为特定的范围。通过recvmsg/recv/read接收数据时，sk_rcvbuf表示接收缓冲区的大小。 sk_rcvbuf值是内核为skb（sk_buff结构体对象）分配的大小。 skb-> trusize是一个变量，它保持对已使用内存的追踪，为了避免内存浪费，方便管理，内核可以在运行时改变skb的大小。 例如，如果我们分配一个大的套接字缓冲区（skb），而我们只接收到1字节大小的数据包，内核将通过调用skb_set_owner_r来调整skb-> trusize的大小。 通过调用skb_set_owner_r修改sk-> sk_rmem_alloc（引用自原子变量sk-> sk_backlog.rmem_alloc）。 当创建XFRM netlink 套接字时，会调用xfrm_dump_policy函数，当我们关闭套接字时，xfrm_dump_policy_done会被调用。 当netlink_sock对象的cb_running值为true时调用xfrm_dump_policy_done。 xfrm_dump_policy_done会尝试清理由netlink_callback对象管理的xfrm walk条目。 当调用netlink_skb_set_owner_r（如skb_set_owner_r）时，它会更新sk_rmem_alloc。 netlink_dump(): 在上面的代码中，我们可以看到当sk-> sk_rcvbuf小于sk_rmem_alloc（注意我们可以通过stockpot控制sk-> sk_rcvbuf）时，netlink_dump()验证失败。 当满足sk-> sk_rcvbuf小于sk_rmem_alloc时，会跳转到函数的结尾，然而cb_running的值还没有被更改为false，netlink_dump()函数就返回了。 此时nlk-> cb_running为true，因此会调用xfrm_dump_policy_done()。 nlk-> cb.done指向xfrm_dump_policy_done，值得注意的是这个函数处理一个双向链表，所以如果利用这个漏洞引用一个可控的缓冲区，我们就可以实现任意内存读写。 漏洞证明 下面的代码在Ubuntu 17.04测试。 [crayon-5a2e498b90418989185807/]

The post SSD安全公告-Linux内核XFRM权限提升漏洞 appeared first on Security Boulevard.

from SSD安全公告-Linux内核XFRM权限提升漏洞

SSD Advisory – Linux Kernel XFRM Privilege Escalation

Vulnerability Summary The following advisory describes a Use-after-free vulnerability found in Linux kernel that can lead to privilege escalation. The vulnerability found in Netlink socket subsystem – XFRM. Netlink is used to transfer information between the kernel and user-space processes. It consists of a standard sockets-based interface for user space processes and an internal kernel … Continue reading SSD Advisory – Linux Kernel XFRM Privilege Escalation

The post SSD Advisory – Linux Kernel XFRM Privilege Escalation appeared first on Security Boulevard.

from SSD Advisory – Linux Kernel XFRM Privilege Escalation

SSD Advisory – Cambium Multiple Vulnerabilities

Vulnerabilities Summary The following advisory describes three (3) vulnerabilities found in Cambium Network Updater Tool and Networks Services Server. The Network Updater Tool is “a free-of-charge tool that applies packages to upgrade the device types that the release notes for the release that you are using list as supported. Because this tool is available, an … Continue reading SSD Advisory – Cambium Multiple Vulnerabilities

The post SSD Advisory – Cambium Multiple Vulnerabilities appeared first on Security Boulevard.

from SSD Advisory – Cambium Multiple Vulnerabilities

SSD Advisory – DblTek Multiple Vulnerabilities

Vulnerabilities summary The following advisory describes 2 (two) vulnerabilities found in DblTek webserver. DBL is “specialized in VoIP products, especially GoIPs. We design, develop, manufacture, and sell our products directly and via distributors to customers. Our GoIP models now cover 1, 4, 8, 16, and 32-channel in order to meet the wide range of market … Continue reading SSD Advisory – DblTek Multiple Vulnerabilities

The post SSD Advisory – DblTek Multiple Vulnerabilities appeared first on Security Boulevard.

from SSD Advisory – DblTek Multiple Vulnerabilities