ProFTPd Arbitrary File Copy Vulnerability (CVE-2019-12815) Threat Alert
![](https://nsfocusglobal.com/wp-content/uploads/2019/04/0506-23.jpg)
August 12, 2019
Overview
Recently, an official security bulletin was released to announce the remediation of an arbitrary file copy vulnerability (CVE-2019-12815) in ProFTPd. This vulnerability lies in the custom SITE CPFR and SITE CPTO operations in the mod_copy module. By issuing the two commands to ProFTPd, an attacker can copy any file on the FTP server without permission. (more…)
Botnet Trend Report-8
![](https://nsfocusglobal.com/wp-content/uploads/2019/06/botnet.jpg)
August 9, 2019
3.5 Delivery and Propagation
3.5.1 Behavior Seen
Studying 25 million intrusion logs extracted from NSFOCUS managed services customers in 2018, we found that approximately 14 million logs recorded intrusions using weak password cracking mainly against Telnet, RDP, and SSH services. From other logs, a large portion of intrusions seen were vulnerability-based intrusions, with 54 vulnerabilities frequently exploited (Shown in the table) mostly against routers and IoT cameras. (more…)
IP Reputation Report-08052019
![](https://nsfocusglobal.com/wp-content/uploads/2019/07/IP-REPUTATION.jpg)
August 8, 2019
Top 10 countries in attack counts: The above diagram shows the top 10 regions with the most malicious IP addresses from the NSFOCUS IP Reputation databases at August 04, 2019. Top 10 countries in attack percentage: The Palestine is in first place. The Curacao is in the second place. The country China (CN) is […]
Jackson-databind Remote Code Execution Vulnerability Technical Analysis
![](https://nsfocusglobal.com/wp-content/uploads/2019/02/0225.jpg)
August 7, 2019
On June 21, Red Hat officially released a security bulletin to announce the fix for a vulnerability in jackson-dababind. This vulnerability with a CVSS score of 8.1 affects multiple Red Hat products and a sophisticated exploit using this vulnerability is observed in the wild. On July 22, a security researcher named Andrea Brancaleoni published an article to analyze this vulnerability. (more…)
Jackson-databind Remote Code Execution Vulnerability (CVE-2019-12384) Threat Alert
![](https://nsfocusglobal.com/wp-content/uploads/2019/04/RSA2019.jpg)
August 6, 2019
Overview
Recently, a security researcher discovered a vulnerability (CVE-2019-12384) in jackson-databind, noting that when certain conditions are met, an attacker, via a malicious request, could bypass the blacklist restriction and remotely execute code in an affected server during deserialization. (more…)
Drupal Access Bypass Vulnerability (CVE-2019-6342) Technical Analysis
![](https://nsfocusglobal.com/wp-content/uploads/2019/03/Drupal.jpg)
August 5, 2019
1 Vulnerability Description
Recently, Drupal released a security advisory on the remediation of an access bypass vulnerability (CVE-2019-6342). In Drupal 8.7.4, when the experimental Workspaces module is enabled, an access bypass condition is created. In terms of the security risk, Drupal rates the vulnerability as Critical. (more…)
Botnet Trend Report-7
![](https://nsfocusglobal.com/wp-content/uploads/2019/06/botnet.jpg)
August 2, 2019
3.4 DDoS Attacks 3.4.1 Behavior Seen Effective attack instructions are botnet attack instructions that control a task other that starting and stopping. Effective attack instructions captured in 2018 included DDoS, Local Area Network (LAN) scanning, and vulnerability exploits among other types of attacks. There were 440,000 DDoS attack instructions issued from botnet families, constituting most […]
IP Reputation Report-07292019
![](https://nsfocusglobal.com/wp-content/uploads/2019/07/IP-REPUTATION.jpg)
August 1, 2019
Top 10 countries in attack counts: The above diagram shows the top 10 regions with the most malicious IP addresses from the NSFOCUS IP Reputation databases at July 28, 2019. Top 10 countries in attack percentage: The Palestine is in first place. The Curacao changes from fourth to second. The country China (CN) is […]
Drupal Access Bypass Vulnerability (CVE-2019-6342) Threat Alert
![](https://nsfocusglobal.com/wp-content/uploads/2019/07/0731-1.jpg)
July 31, 2019
Overview
On July 17, 2019, local time, Drupal released a security advisory on the remediation of an access bypass vulnerability (CVE-2019-6342). In Drupal 8.7.4, when the experimental Workspaces module is enabled, an access bypass condition is created. In terms of the security risk, Drupal rates the vulnerability as Critical. (more…)
DDoS Attack Misinterpretations
![](https://nsfocusglobal.com/wp-content/uploads/2019/07/0730-1.jpg)
July 30, 2019
River blockage used to be a great survival crisis in ancient times. Similarly in cyberspace, distributed denial-of-service (DDoS) attacks have become a devastating disaster. As we all know, DDoS attacks are destructive attacks and after over 10 years of evolution, such attacks have become an effective attack tool favored by multiple organizations and individuals who use them for ransom, revenge and cyberwars. (more…)