Subscribe: SecuriTeam Blogs
http://blogs.securiteam.com/?feed=rss2
Preview: SecuriTeam Blogs

SecuriTeam Blogs





Last Build Date: Tue, 14 Nov 2017 12:27:06 +0000

 



SSD安全公告-思科UCS平台模拟器远程代

Tue, 14 Nov 2017 12:27:06 +0000

漏洞概要 以下安全公告描述了在思科UCS平台模拟器3.1(2ePE1)中发现的两个远程代码执行漏洞。 思科UCS平台模拟器是捆绑到虚拟机(VM)中的Cisco UCS Manager应用程序,VM包含模拟思科统一计算系统(Cisco UCS)硬件通信的软件,思科统一计算系统(Cisco UCS)硬件由思科UCS Manager配置和管理。 例如,你可以使用思科UCS平台模拟器来创建和测试支持的思科UCS配置,或者复制现有的思科UCS环境,以进行故障排除或开发。 在思科UCS平台模拟器中发现的漏洞是: 未经验证的远程代码执行漏洞 经认证的远程代码执行漏洞 一名独立的安全研究者向 Beyond Security 的 SSD 报告了该漏洞。 厂商响应 厂商已经发布了该漏洞的补丁,并发布以下CVE: CVE-2017-12243 漏洞详细信息 未经验证的远程代码执行漏洞 由于用户的输入在传递给IP/settings/ping函数时没有进行充分的过滤,导致未经身份验证的攻击者可以通过ping_NUM和ping_IP_ADDR参数注入命令,这些命令将在远程机器上以root身份执行。 漏洞证明 [crayon-5a0fdcbcf0743384830365/] 通过发送以上请求之一后,思科 UCS响应如下: [crayon-5a0fdcbcf074a063564415/] 经认证的远程代码执行漏洞 思科UCS平台模拟器容易受到格式字符串漏洞的攻击,导致远程代码执行。 思科UCS平台模拟器默认运行一个SSH服务器,通过ssh登录的用户运行以下命令: [crayon-5a0fdcbcf074d263374391/] 得到下面的响应: [crayon-5a0fdcbcf0750855088837/] 可以看到,通过执行ssh“show sel %x”命令,我们用libsamvsh.so中的system函数覆写了_ZN7clidcos15CommandEmulator16cli_param_filterEPKc函数的入口。 漏洞证明 为了利用此漏洞,请按照以下说明操作: 使用以下用户名和密码在vm上安装ucspe(安装全部3个网卡): 默认的ucspe用户:ucspe 默认的ucspe密码:ucspe 运行ucspe并记下ucspe的ip地址(在控制台可以看到“Connected to IP: ….”) 在这次漏洞证明中,我们将会使用ip-192.168.1.43。 在另一台机器上打开两个终端(例如Kali) 首先,在第一个终端上执行如下操作: 创建poc目录,将poc4_ucspe_3.1.2e.py放入poc目录,然后将当前目录改为poc目录 创建fifo1: [crayon-5a0fdcbcf0753992728056/] 创建输出目录: [crayon-5a0fdcbcf0755985580455/] … Continue reading SSD安全公告-思科UCS平台模拟器远程代



SSD 安全公告-McAfee LiveSafe MiTM 注册表 修改导致远程执行命令漏洞

Tue, 14 Nov 2017 12:11:39 +0000

漏洞概要 以下安全公告描述了在 McAfee LiveSafe (MLS) 中存在的一个远程命令执行漏洞,该漏洞影响了McAfee LiveSafe(MLS)16.0.3 之前全部版本. 之前全部版本. 漏洞允许网络攻击者通过篡改 HTTP 后端响应, 进而修改与 McAfee 更新相关的 Windows 注册表值. McAfee Security Scan Plus 是一个免费的诊断工具,通过主动地检查计算机中最新的防病毒软件、防火墙和网络安全软件更新,确保用户免受威胁,同时还会扫᧿正在运行程序中的威胁. 漏洞ᨀ交者 一家独立的安全研究公司 Silent Signal 向 Beyond Security 的 SSD 报告了该漏洞。 厂商响应 厂商已经发布针对该漏洞的补丁地址。获取更多信息: https://service.mcafee.com/webcenter/portal/cp/home/articleview?articleId=TS102714 CVE: CVE-2017-3898 漏洞详细信息 网络攻击者可以在多个 McAfee 产品中实现远程代码执行。受影响的产品会通过明文 HTTP 通道从 http://COUNTRY.mcafee.com/apps/msc/webupdates/mscconfig.asp 中检索配置数据 (其中的“COUNTRY”修改为国家的两字母标识符,例如“uk”) 响应的正文包含 XML 格式数据,类似于下面的代码: [crayon-5a0fdcbcf0fb5624441494/] 上述响应᧿述了在 webservice-response/update 路径下使用 reg 标签进行注册表修改的行为。 … Continue reading SSD 安全公告-McAfee LiveSafe MiTM 注册表 修改导致远程执行命令漏洞



SSD安全公告–Ametys CMS未经身份验证

Tue, 14 Nov 2017 12:10:25 +0000

漏洞概要 下面我们将描述在Ametys CMS 4.0.2版本中发现的密码重置漏洞。 Ametys是一个免费的开源内容管理系统(CMS),它基于JSR-170存储内容,有公开的小工具和一个面向xml的框架。 漏洞提交者 一位独立的安全研究人员—何塞·路易斯(Jose Luis),向Beyond Security的SSD报告了该漏洞。 厂商响应 Ametys已经发布了修补该漏洞的补丁-Ametys CMS 4.0.3 获取更多细节:https://issues.ametys.org/browse/RUNTIME-2582 漏洞详细信息 由于对用户的输入没有进行充分的检查,导致未经验证的用户可以执行未授权的管理操作。 Ametys CMS仅在Web请求中包含/cms/时才检查授权。这样,我们就可以重置任何用户的密码,包括管理员用户。 漏洞证明 通过发送以下POST请求,我们可以获得用户列表: [crayon-5a0fdcbcf1650345233494/] 然后,服务器将响应如下: [crayon-5a0fdcbcf165c593304844/] 从服务器的响应中可以获取到字段“populationId”和“login”的值,这些值将会用于下一个请求。 现在,我们需要执行另一个请求来更改admin用户的密码: [crayon-5a0fdcbcf1661682869715/] 执行这个请求后,服务器将响应: [crayon-5a0fdcbcf1666103785713/] 现在,你可以使用密码MYNEWPASSWORD以管理员身份登录系统。



SSD Advisory – Ametys CMS Unauthenticated Password Reset

Tue, 07 Nov 2017 09:23:50 +0000

Vulnerability Summary The following advisory describes a password reset vulnerability found in Ametys CMS version 4.0.2 Ametys is “a free and open source content management system (CMS) written in Java. It is based on JSR-170 for content storage, Open Social for gadget rendering and a XML oriented framework.” Credit An independent security researcher, Jose Luis, … Continue reading SSD Advisory – Ametys CMS Unauthenticated Password Reset



SSD Advisory – Cisco UCS Platform Emulator Remote Code Execution

Wed, 01 Nov 2017 05:08:10 +0000

Vulnerabilities Summary The following advisory describes two remote code execution vulnerabilities found in Cisco UCS Platform Emulator version 3.1(2ePE1). Cisco UCS Platform Emulator is the Cisco UCS Manager application bundled into a virtual machine (VM). The VM includes software that emulates hardware communications for the Cisco Unified Computing System (Cisco UCS) hardware that is configured … Continue reading SSD Advisory – Cisco UCS Platform Emulator Remote Code Execution



SSD Advisory – GraphicsMagick Multiple Vulnerabilities

Tue, 31 Oct 2017 17:25:29 +0000

Vulnerabilities summary The following advisory describes two (2) vulnerabilities found in GraphicsMagick. GraphicsMagick is “The swiss army knife of image processing. Comprised of 267K physical lines (according to David A. Wheeler’s SLOCCount) of source code in the base package (or 1,225K including 3rd party libraries) it provides a robust and efficient collection of tools and … Continue reading SSD Advisory – GraphicsMagick Multiple Vulnerabilities



SSD Advisory – ZTE ZXR10 Router Multiple Vulnerabilities

Mon, 23 Oct 2017 10:35:08 +0000

Vulnerabilities summary The following advisory describes five (5) vulnerabilities found in ZTE ZXR10 Router. ZXR10 ZSR V2 series router is “the next generation intelligent access router product of ZTE, which integrates routing, switching, wireless, security, and VPN gateway. The product adopts industry-leading hardware platform and software architecture to provide an intelligent and flexible platform for … Continue reading SSD Advisory – ZTE ZXR10 Router Multiple Vulnerabilities



SSD Advisory – K7 Total Security Device Driver Arbitrary Memory Read

Mon, 23 Oct 2017 10:31:38 +0000

Vulnerability Summary The following advisory describes an Crash found in K7 Total Security. Credit An independent security researcher, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program Vendor response K7 has released patches to address this vulnerability – K7TotalSecurity version 15.1.0.305 Vulnerability details User controlled input to K7Sentry device is not sufficiently sanitized, … Continue reading SSD Advisory – K7 Total Security Device Driver Arbitrary Memory Read



SSD Advisory – Geneko Routers Information Disclosure

Mon, 23 Oct 2017 10:26:40 +0000

Vulnerability Summary The following advisory describes an information disclosure vulnerability found in Geneko Routers version 3.18.21 Geneko GWG is “compact and cost effective communications solution that provides cellular capabilities for fixed and mobile applications such as data acquisition, smart metering, remote monitoring and management. GWG supports a variety of radio bands options on 2G, 3G … Continue reading SSD Advisory – Geneko Routers Information Disclosure



SSD Advisory – Endian Firewall Stored From XSS to Remote Command Execution

Wed, 18 Oct 2017 14:00:07 +0000

Vulnerability Summary The following advisory describes a stored cross site scripting that can be used to trigger remote code execution in Endian Firewall version 5.0.3. Endian Firewall is a “turnkey Linux security distribution, which is an independent, unified security management operating system. The Endian Firewall is based on a hardened Linux operating system.” Credit An … Continue reading SSD Advisory – Endian Firewall Stored From XSS to Remote Command Execution



SSD Advisory – HPE Baseline Smart Gig SFP 24 Switch Pre-authentication Stored XSS

Wed, 18 Oct 2017 05:42:41 +0000

Vulnerability Summary The following advisory describes an unauthenticated stored XSS in the HPE Baseline Smart Gig SFP 24 / 3Com Baseline Switch 2924 SFP Plus Switch. The vulnerability affect versions: Software Version: 01.00.10 Boot version: 1.0.0.14 Hardware Version: 01.01.0a “On April 12, 2010, Hewlett-Packard completed the acquisition of 3Com. Since the acquisition, 3Com has been … Continue reading SSD Advisory – HPE Baseline Smart Gig SFP 24 Switch Pre-authentication Stored XSS



SSD Advisory – Linux Kernel AF_PACKET Use-After-Free

Tue, 17 Oct 2017 11:42:53 +0000

Vulnerabilities summary The following advisory describes a use-after-free vulnerability found in Linux Kernel’s implementation of AF_PACKET that can lead to privilege escalation. AF_PACKET sockets “allow users to send or receive packets on the device driver level. This for example lets them to implement their own protocol on top of the physical layer or to sniff … Continue reading SSD Advisory – Linux Kernel AF_PACKET Use-After-Free



SSD Advisory – Ikraus Anti Virus Remote Code Execution

Mon, 16 Oct 2017 09:21:04 +0000

Vulnerability summary The following advisory describes an remote code execution found in Ikraus Anti Virus version 2.16.7. KARUS anti.virus “secures your personal data and PC from all kinds of malware. Additionally, the Anti-SPAM module protects you from SPAM and malware from e-mails. Prevent intrusion and protect yourself against cyber-criminals by choosing IKARUS anti.virus, powered by … Continue reading SSD Advisory – Ikraus Anti Virus Remote Code Execution



SSD Advisory – Webmin Multiple Vulnerabilities

Sun, 15 Oct 2017 06:54:31 +0000

Vulnerability summary The following advisory describes three (3) vulnerabilities found in Webmin version 1.850 Webmin “is a web-based interface for system administration for Unix. Using any modern web browser, you can setup user accounts, Apache, DNS, file sharing and much more. Webmin removes the need to manually edit Unix configuration files like /etc/passwd, and lets … Continue reading SSD Advisory – Webmin Multiple Vulnerabilities



SSD Advisory – ZTE uSmartView DLL Hijacking

Sun, 15 Oct 2017 06:43:40 +0000

Vulnerability summary The following advisory describes an DLL Hijacking found in ZTE uSmartView. ZTE uSmartView offers: “ZTE provides full series of cloud computing products (including cloud terminals, cloud desktops, virtualization software, and cloud storage products) and end-to-end integrated product, which can be applied to different scenarios such as office, training classroom, multimedia classroom, and business … Continue reading SSD Advisory – ZTE uSmartView DLL Hijacking



SSD安全公告 – Mac OS X 10.12隔离机制绕过漏洞

Sun, 15 Oct 2017 06:02:53 +0000

漏洞概要 Mac OS X存在一个漏洞,该漏洞允许攻击者绕过Apple的隔离机制,不受任何限制执行任意JavaScript代码. 漏洞提交者 来自WeAreSegment的安全研究者Filippo Cavallarin向Beyond Security的SSD报告了该漏洞. 厂商响应 苹果公司已于2017年6月27日收到了我们的报告,并和我们进行了多次沟通。苹果公司通知我们,在即将发布的High Sierra操作系统中会修补这个漏洞。这之后,苹果公司再没有提供任何其他信息 – 既没有链接公告,也没有提供关于CVE编号分配的任何信息. 我们已经验证在Mac OS X High Sierra中已不存在该漏洞。对于该漏洞的解决办法是升级到Mac OS X High Sierra,或者移除rhtmlPlayer.html文件修复该漏洞. 漏洞详细信息 苹果隔离机制的运行原理是在下载的文件上设置一个扩展属性(从已下载的归档文档/图片提取的文件也适用),以便系统在受限制的环境中打开/执行这些文件. 例如,一个被隔离的HTML文件不能加载本地资源. 此漏洞存在于一个html文件(Mac OS X内核的一部分)中,容易受到基于DOM的XSS攻击,允许在其(无限制)上下文中执行任意JavaScript命令. 上述文件的具体路径为:/System/Library/CoreServices/HelpViewer.app/Contents/Resources/rhtmlPlayer.html 文件包含如下代码: [crayon-5a0fdcbd02577248483949/] 简而言之,这段代码从“rhtml”查询字符串参数中提取URL地址,向该URL发出请求,并将响应数据作为JavaScript代码加以执行. 下面的代码包含两段不同的基于DOM的XSS的代码。第一个是在loadLocStrings()函数中创建一个SCRIPT元素,并使用“rhtml”参数作为其“src”属性。第二个是在init()函数中使用“rhtml”参数进行ajax调用,然后将响应直接传递给eval()。这样做的结果是同样的载荷被执行两次. 攻击者通过提供一个uri,就可以控制响应数据,进而获得代码执行. 通过使用.webloc文件是一种可能的漏洞利用方式。基本上这些文件都包含一个URL,他们只需在Safari中加载即可。通过构造一个.webloc文件,并诱导受害者打开,攻击者就可以在受害者的计算机上以高权限执行JavaScript命令. 由于.webloc文件同样使用扩展属性来存储数据,因此攻击者必须将文件打包放在tar文件中(或其他任何支持扩展属性的文件格式)中. 漏洞证明 通过以下步骤复现漏洞 创建一个你想要要在目标上执行的JavaScript文件 使用base64对文件内容编码 将其编码为“uri组件”(比如,使用js的encodeURIComponent函数完成这个任务) 使用它来构造如下形式的uri:data:text / plain; base64, 在开头添加如下字符串:file:///System/Library/CoreServices/HelpViewer.app/Contents/Resources/rhtmlPlayer.html?rhtml = 使用Safari打开它 将其另存为书签 将该书签拖放到Finder中(此时会创建一个.webloc文件,如果扩展名不是.webloc,重命名为.webloc) 创建一个包含.webloc文件的tar归档文件 将归档文件发送给受害者 请注意,受限于rhtmlPlayer.html的处理流程,为了访问本地资源,JavaScript代码的第一行必须是: [crayon-5a0fdcbd02583156939735/] 以下bash脚本会将JavaScript文件转换为最终的“文件”URL: … Continue reading SSD安全公告 – Mac OS X 10.12隔离机制绕过漏洞