Events

Local Privilege Escalation Vulnerability in Latest Ubuntu Server

March 19, 2018 | Adeline Zhang

  The latest Ubuntu Server has exposed a local privilege escalation vulnerability (CVE-2017-16995). This vulnerability has been fixed in earlier versions but has resurfaced in the latest version. Attackers can directly gain root privileges through this vulnerability. Currently Ubuntu has not released the patch yet. Affected version: Currently we know:  Ubuntu 16.04.4 (the latest version) […]

Remote Code Execution Vulnerability in ManageEngine Applications Manager 13.5

March 14, 2018 | Adeline Zhang

Recently, researchers discovered a serious remote code execution (RCE) vulnerability (CVE-2018-7890) in ManageEngine Applications Manager. Vulnerabilities originate from the publicly accessible testCredential.do endpoint, which can result in remote code execution when validating user-supplied credentials. At present, no official version has been released to fix this vulnerability. Reference links: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7890 https://www.securityfocus.com/bid/103358 https://pentest.blog/advisory-manageengine-applications-manager-remote-code-execution-sqli-and/ What is ManageEngine Applications Manager? […]

NSFOCUS Found Multiple Vulnerabilities in Schneider Pelco Sarix professional Cameras

March 6, 2018 | Adeline Zhang

Multiple vulnerabilities were found by NSFOCUS researchers in Schneider Pelco Sarix professional Cameras. These vulnerabilities included: CVE# Vulnerability Severity CVE-2018-7227 Information Disclosure Medium CVE-2018-7228 Admin Privilege Authentication Bypass High CVE-2018-7229 Admin Privilege Authentication Bypass High CVE-2018-7230 XML External Entity Vulnerability High CVE-2018-7231 Command Execution – ‘system.opkg.remove’ Critical CVE-2018-7232 Command Execution – ‘network.ieee8021x.delete_certs’ Critical CVE-2018-7233 Command […]

Technical Analysis and Solution of WebLogic Server (WLS) Component Vulnerability

December 25, 2017 | Adeline Zhang

Overview Recently, NSFOCUS has received a slew of reports from customers in the finance, telecom, and Internet sectors on similar security events. Through analysis, NSFOCUS believes that these events are all associated with the malware-infected WebLogic Server (WLS) host. Specifically, attackers exploit the WLS component vulnerability (CVE-2017-10271) to attack the WLS middleware host via a […]

Miner Virus Attacked Large Numbers of WebLogic Hosts Recently

December 23, 2017 | Adeline Zhang

On the 15th this month, K.Orange twittered a message, saying that unpatched WebLogic has a vulnerability that could be employed by attackers using a “watch-smartd” program. Recently NSFOCUS received requests from customers in many industries (finance, telecom carriers, the Internet companies and so on) asking for emergence response service as they found the “watch-smartd” program […]

IcedID Banking Trojan Sample Technical Analysis and Solution

December 1, 2017 | Adeline Zhang

IcedID Banking Trojan Sample Technical Analysis and Solution Date of Release: November 17, 2017 Overview Recently, the IBM X-Force research team discovered a brand new banking Trojan dubbed IcedID. This Trojan was first found spreading in the wild in September 2017, mainly targeting systems used in the financial sectors of US. According to X-Force research, […]

BadRabbit Sample Analysis and Recommended Solution

November 2, 2017 | Adeline Zhang

Overview A new type of ransomware was detected on October 24, when it had not been even half a year from the extensive breakout of the notorious ransomware Petya and WannaCry. This ransomware dubbed BadRabbit has been distributed in a number of European countries, including Russia, Ukraine, Bulgaria, Turkey, and Germany, and is now found […]

Analysis and Solution of Spring Data REST Server PATCH Request RCE Vulnerability

October 11, 2017 | Adeline Zhang

  Overview Recently, Pivotal released a security advisory to reveal the Spring Data REST server is prone to a remote code execution vulnerability (CVE-2017-8046) when processing PATCH requests. Attackers could exploit this vulnerability by sending a crafted PATCH request to the Spring Data REST server. The submitted JSON data contains a SPEL expression, which could […]

Phantom Squad – DDoS Threat

September 26, 2017 | Adeline Zhang

Overview It appears that the new syndicate of the Armada Collective referred to as the Phantom Squad is planning to launch a global DDoS attack on September 30th.  Below you will find a screenshot of the mass spear-phishing email that has been distributed to many organization and companies around the world. They are currently asking […]

Struts 2 S2-052 REST Plug-in Remote Code Execution Vulnerability Analysis

September 8, 2017 | Adeline Zhang

Overview On September 5, 2017, Apache Struts released the latest security bulletin announcing that the REST plug-in in Apache Struts 2.5.x and some 2.x versions is prone to a high-risk remote code execution vulnerability, which has been assigned CVE-2017-9805 (S2-052). When using an XStream handler with an instance of XStream for deserialization, the REST plug-in […]