Last month, a security researcher published a critical vulnerability (CVE-2018-9995) in several Digital Video Recorders (DVR). As DVR is typically connected to home or business security cameras, compromising it can give attackers access to live feeds from all the cameras they are connected to. The researcher also released a proof-of-concept code for the vulnerability, getDVR_Credentials. … Continue reading “Multiple DVR Products Authentication Bypass Vulnerability”
Author: Mandar Jadhav
GPON Home Routers Multiple Security Vulnerabilities
A couple of vulnerabilities affecting over one million GPON routers were disclosed recently. One of them was an Authentication Bypass vulnerability (CVE-2018-10561) and other one was a Command Injection vulnerability (CVE-2018-10562). An attacker can chain these vulnerabilities to execute arbitrary code on the targeted devices. A security researcher published his findings along with POC on … Continue reading “GPON Home Routers Multiple Security Vulnerabilities”
HP Intelligent Management Center (iMC) RMI Registry Java Deserialization Remote Code Execution Vulnerability
HPE Intelligent Management Center Enterprise Software Platform is a comprehensive wired and wireless network management tool supporting the FCAPS model, provides for end-to-end business management of IT, scalability of system architecture, and accommodation of new technology and infrastructure. Vulnerability: A deserialization vulnerability has been reported in the HPE Intelligent Management Center (iMC). The vulnerability is … Continue reading “HP Intelligent Management Center (iMC) RMI Registry Java Deserialization Remote Code Execution Vulnerability”
LibreOffice Remote Arbitrary File Disclosure Vulnerability via WEBSERVICE Function
LibreOffice Calc is the spreadsheet component of the LibreOffice software package. LibreOffice Calc supports a WEBSERVICE function to obtain data by URL. Details: LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via WEBSERVICE calls in a document (CVE-2018-6871), which uses the COM.MICROSOFT.WEBSERVICE function. This feature is available in Microsoft … Continue reading “LibreOffice Remote Arbitrary File Disclosure Vulnerability via WEBSERVICE Function”
Apple MacOS High Sierra ‘root’ Access With No Password
A critical security flaw in macOS High Sierra, aka macOS 10.13, allows users to gain admin rights, or log in as root, without a password. The consequences could be serious. Anyone having physical access to the system can log in to your user account, unlock your keychain and reveal your passwords, turn off FileVault, OS … Continue reading “Apple MacOS High Sierra ‘root’ Access With No Password”
Oracle Releases Patches for JOLTANDBLEED Vulnerabilities
Introduction: Oracle pushed out an emergency update for vulnerabilities dubbed ‘JoltandBleed’ affecting five of its products that rely on its proprietary Jolt protocol. Two vulnerabilities (CVE-2017-10272 and CVE-2017-10269) discovered were severe and attackers can exploit these vulnerabilities without the need of valid credentials. This will allow an attacker to gain full access to all data … Continue reading “Oracle Releases Patches for JOLTANDBLEED Vulnerabilities”
Westermo MRD-305-DIN, MRD-315, MRD-355 and MRD-455 Multiple Security Vulnerabilities
Westermo provides a full range of industrial data communications (SCADA) solutions for demanding applications in the transport, water and energy markets among others. MRD devices provide resilient remote access and eliminate the need for costly site visits. With support for secure VPN communications, static and dynamic IP routing, NAT, port forwarding, OpenVPN (SSL VPN), and … Continue reading “Westermo MRD-305-DIN, MRD-315, MRD-355 and MRD-455 Multiple Security Vulnerabilities”
Foxit Reader and PhantomPDF Multiple Code Execution Vulnerabilities
Recently, ZDI published two 0day advisories ZDI-17-691 and ZDI-17-692 for vulnerabilities in Foxit Reader & PhantomPDF. These are Command Injection and File Write vulnerabilities that can be triggered through the JavaScript API in Foxit Reader. These vulnerabilities are not memory corruption vulnerabilities. Details: CVE-2017-10951 (ZDI-CAN-4724): This allows the “app.launchURL” method to execute a system call … Continue reading “Foxit Reader and PhantomPDF Multiple Code Execution Vulnerabilities”
Citrix NetScaler SD-WAN and CloudBridge Virtual WAN Management Interface Remote Code Execution Vulnerability
Recently, a remote code execution vulnerability was discovered in the Citrix NetScaler SD-WAN and Citrix CloudBridge tracked as CVE-2017-6316. The vulnerability exist in the session management functionality. If the cookie holds shell-command data – it is used in a call to system where input is processed unsanitized. This allows an attacker to execute arbitrary commands … Continue reading “Citrix NetScaler SD-WAN and CloudBridge Virtual WAN Management Interface Remote Code Execution Vulnerability”
Brickcom Devices Multiple Security Vulnerabilities
While doing research on the IP surveillance solutions, we came across a company called Brickcom Corporation. Brickcom is a network video manufacturer in the IP surveillance industry. We started testing the latest firmware 3.7.0.2aR. It’s based on Linux and the file system is ‘Squashfs’ compressed with LZMA. We extracted the ‘Squashfs’ file system using open … Continue reading “Brickcom Devices Multiple Security Vulnerabilities”