Alerts

 

CVE No: CVE-2018-7600

Modification History: March 21 2018 – April 19 2018

CVSS Score: 9.8

Risk Level: Critical

Product Affected: Drupal 7.x, 8.3.x, 8.4.x, and 8.5.x

 

Description:

Drupal has been found critical vulnerability that could allow remote attackers to pull off advanced attacks including cookie theft, keylogging, phishing and identity theft.

Discovered by the Drupal security team, the open source content management framework is vulnerable to cross-site scripting (XSS) vulnerability that resides in a third-party plugin CKEditor which comes pre-integrated in Drupal core to help site administrators and users create interactive content.

CKEditor is a popular JavaScript-based WYSIWYG rich text editor which is being used by many websites, as well as comes pre-installed with some popular web projects.

According to a security advisory released by CKEditor, the XSS vulnerability stems from the improper validation of “img” tag in Enhanced Image plugin for CKEditor 4.5.11 and later versions

This could allow an attacker to execute arbitrary HTML and JavaScript code in the victim’s browser and gain access to sensitive information.

Enhanced Image plugin was introduced in CKEditor 4.3 and supports an advanced way of inserting images into the content using an editor.

CKEditor has patched the vulnerability with the release of CKEditor version 4.9.2, which has also been patched in the CMS by the Drupal security team with the release of Drupal version 8.5.2 and Drupal 8.4.7.

Since CKEditor plugin in Drupal 7.x is configured to load from the CDN servers, it is not affected by the flaw.

However, if you have installed the CKEditor plugin manually, you are advised to download and upgrade your plugin to the latest version from its official website.

Drupal recently patched another critical vulnerability, dubbed Drupalgeddon2, a remote code execution bug that allows an unauthenticated, remote attacker to execute malicious code on default or common Drupal installations under the privileges of the user, affecting all versions of Drupal from 6 to 8.

However, due to people’s laziness of patching their systems and websites timely, the Drupalgeddon2 vulnerability has been found exploiting in the wild by hackers to deliver cryptocurrency miners, backdoors, and other malware.

Therefore, users are highly recommended always to take security advisories seriously and keep their systems and software up-to-date in order to avoid become victims of any cyber-attack.

Solution:

  • Upgrade CKEditor 4.5.11+  to CKEditor 4.9.2 that contains a security fix for the Enhanced Image plugin.
  • Sites on 8.3.x should immediately update to the 8.3.x release that will be provided in the advisory, and then plan to update to the latest 8.5.x security release in the next month.
  • Sites on 8.4.x should immediately update to the 8.4.x release that will be provided in the advisory, and then plan to update to the latest 8.5.x security release in the next month.
  • Sites on 7.x or 8.5.x can immediately update when the advisory is released using the normal procedure.

 

The information contained in this website is for general information purposes only. The information is gathered from Drupal while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.
Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them.
Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.

AMD has finally acknowledged 13 critical vulnerabilities, and exploitable backdoors in its Ryzen and EPYC processors disclosed earlier this month by Israel-based CTS Labs and promised to roll out firmware patches for millions of affected devices ‘in the coming weeks.’

According to CTS-Labs researchers, critical vulnerabilities (RyzenFall, MasterKey, Fallout, and Chimera) that affect AMD’s Platform Security Processor (PSP) could allow attackers to access sensitive data, install persistent malware inside the chip, and gain full access to the compromised systems.

Although exploiting AMD vulnerabilities require admin access, it could help attackers defeat important security features like Windows Credential Guard, TPMs, and virtualization that are responsible for preventing access to the sensitive data from even an admin or root account.

In a press release published by AMD on Tuesday, the company downplays the threat by saying that, “any attacker gaining unauthorised administrative access would have a wide range of attacks at their disposal well beyond the exploits identified in this research.”
However, AMD claims patches and updates for these critical flaws are not expected to impact device performance.

Responsible Disclosure Controversy

Infosec experts and journalists embroiled CTS Labs into controversies by raising questions over the way it disclosed vulnerabilities details to the public in less than 24 hours after notifying AMD.

However, it’s important to note that CTS Labs researchers did not disclose any technical information about the flaws to the public that could harm AMD users in any way.

According to Ilia Luk-Zilberman, CTO of CTS-Labs, the current process of ‘Responsible Disclosure’ has two significant problems:

If researcher gives a 30/45/90 days limit to the affected vendor, it’s extremely rare that the vendor would notify its customers about the unpatched security vulnerabilities during this period, leaving them unaware of potential risks.
If vendors do not respond or patch the vulnerability during this 90-day disclosure period, researchers can proudly prefer to go public with full technical details of the flaws, ultimately putting their customers at risk.

Zilberman understands the need for both steps, but with his style of disclosing “AMD flaws,” the company proposes an alternative ‘Responsible Disclosure’ process that:

notifies affected customers about the impact,
ensures public pressure on the vendor to get patches as soon as possible,
involves third-party experts to verify the flaws, and
at the same time never put customers at risk.

I think that a better way, would be to notify the public on day 0 that there are vulnerabilities and what is the impact. To notify the public and the vendor together. And not to disclose the actual technical details ever unless it’s already fixed. To put the full public pressure on the vendor from the get go, but to never put customers at risk,” Zilberman said.

Anyway, CTS Labs also claimed that AMD could take several months to release patches for most of the issues, where some of them cannot be fixed.

 

The information contained in this website is for general information purposes only. The information is provided by The hackers news while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.
Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them.
Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control

Every January we calculate and then publish a “Top Twenty” list of the “shadiest” TLDs in the hope that highlighting the vast amounts of abuse will prompt some changes in behavior. Occasionally, it works and a TLD registry will reach out to ask how to screen out some of the riff-raff. More often, though, the abuse continues as Internet scammers and hackers seek to game the system. But at least folks outside of our customer base now have some additional warning about the risks they face.

Accordingly, here are the Top Twenty Shady TLDs, as of the close of 2017.

 

 

* As of late December 2017. Shady Percentage is a simple calculation: the ratio of “domains and subdomains ending in this TLD which are rated in our database with a ‘shady’ category, divided by the total number of database entries ending in this TLD”.

 

The information contained in this website is for general information purposes only. The information is provided by SYMANTEC while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.
Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them.
Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control

Ransomware, Phishing, Online Scams expanded the risk of Black Hat Hackers. We are living in a computerized world where everything is associated with the Internet.

Individuals are getting hacked and if your advanced life is traded off, anybody can destroy your life inside a couple of hours.An examination uncovers 45 percent of Individuals Use Same Password for Social Networking and Email.

Discovering data for somebody generally, relies upon the trails casualty leave on the web. Data gathering is the initial step of Hacking. Your name, email, telephone number, date of birth and your present area can give an entrance to the programmers.

 

Open Network – Hackers

Actually, when you turn on the Wi-Fi motion on your cell phone or log on the web, you are a potential focus for a programmer. On the off chance that you are utilizing the open system or Wi-Fi and getting to your messages account with no VPN, it implies your data is open for everybody.

Programmers dependably target open or open Wi-Fi to sniff your data. Anything you sent or get could be caught by programmers. Maybe you are savvy enough to comprehend the contrast between HTTP or HTTPS convention yet you are not more astute than a programmer who is utilizing SSL Strip Attack to decode your SSL activity.

An ideal approach to secure yourself on an open system is to utilize a Virtual Private Network (VPN).

Phishing

Phishing is a sort of social designing assault frequently used to take client information, including login accreditations and Visa numbers. It happens when an assailant, make a copy page as a trusted element and persuade a casualty into opening an email or instant message.

The casualty is then deceived into clicking a malignant connection, which diverts clients to enter their own points of interest. Tab Napping is additionally a propelled method for phishing assault.

PC Privacy

After Ransomware, malware assault is normal and spreading everywhere throughout the world. New Attack called leaker locker malware is likewise contaminating bunches of individuals.

A portion of the malware are encoding your information and other may gather the data from your framework and could send your points of interest to different servers. Keylogger is outstanding amongst other cases that may send every one of your keystrokes to the programmer.

Try not to download programming from untrusted sites. Programmers dependably target Torrent site to spread the completely imperceptible malware, Trojan. keylogger in your machine.

Web-based social networking Activities

Maybe you are utilizing the solid secret key on your online networking record to guard your record, however, they can get a thought of you. The most well-known approach to accumulate somebody’s close to home data is through Social Engineering.

No big surprise might be a programmer is visiting with you every day to pick up your own data. A speedy google pursuit can uncover your Instagram, Facebook, and LinkedIn to programmers.

Keep in mind forget one online networking account rupture could without much of a stretch lead a programmer to duplicate the greater part of your discussions, points of interest, your present area.

In the event that your Gmail account is traded off, programmers can introduce any application to your android telephone remotely and after that control your life. Startling yet Truth.

 

The information contained in this website is for general information purposes only. The information is provided by techincidents and while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.
Through this website, you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them.
Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control

the most severe of which could allow for remote code execution. Android is an operating system developed by Google for mobile devices, including, but not limited to, smartphones, tablets, and watches. Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution within the context of a privileged process. Depending on the privileges associated with this application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

Details of these vulnerabilities are as follows:

  • Multiple remote code execution vulnerabilities in Media Framework (CVE-2017-13228, CVE-2017-13230).
  • An information disclosure vulnerability in Media Framework (CVE-2017-13232).
  • An elevation of privilege vulnerability in Media Framework (CVE-2017-13231).
  • Multiple denial of service vulnerabilities in Media Framework (CVE-2017-13230, CVE-2017-13233, CVE-2017-13234).
  • An elevation of privilege vulnerability in System (CVE-2017-13236).
  • An information disclosure vulnerability in HTC components (CVE-2017-13238).
  • An elevation of privilege vulnerability in HTC components (CVE-2017-13247).
  • Multiple elevation of privilege vulnerabilities in Kernel components (CVE-2017-15265, CVE-2015-9016, CVE-2017-17770).
  • Multiple elevation of privilege vulnerabilities in NVIDIA components (CVE-2017-6279, CVE-2017-6258).
  • Multiple remote code execution vulnerabilities in Qualcomm components (CVE-2017-15817, CVE-2017-17760).
  • Multiple elevation of privilege vulnerabilities in Qualcomm components (CVE-2017-11041, CVE-2017-17767, CVE-2017-17765, CVE-2017-17762, CVE-2017-14884, CVE-2017-15829, CVE-2017-15820, CVE-2017-17764, CVE-2017-17761).
  • A vulnerability in the Qualcomm closed-source components (CVE-2017-14910).

Successful exploitation of the most severe of these vulnerabilities could allow for remote code execution in the context of a privileged process. These vulnerabilities could be exploited through multiple methods such as email, web browsing, and MMS when processing media files. Depending on the privileges associated with the application, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. If this application has been configured to have fewer user rights on the system, exploitation of the most severe of these vulnerabilities could have less impact than if it was configured with administrative rights.

RECOMENDATIONS:

We recommend the following actions be taken:

  • Apply appropriate updates provided by Google Android or mobile carriers to vulnerable systems, immediately after appropriate testing.
  • Remind users to only download applications from trusted vendors in the Play Store.
  • Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.
  • Inform and educate users regarding threats posed by hypertext links contained in emails or attachments, especially from un-trusted sources.

 

The information contained in this website is for general information purposes only. The information is provided by Android Security Bulletin and while we endeavour to keep the information up to date and correct, we make no representations or warranties of any kind, express or implied, about the completeness, accuracy, reliability, suitability or availability with respect to the website or the information, products, services, or related graphics contained on the website for any purpose. Any reliance you place on such information is therefore strictly at your own risk.
Through this website you are able to link to other websites which are not under the control of CSIRT-CY. We have no control over the nature, content and availability of those sites. The inclusion of any links does not necessarily imply a recommendation or endorse the views expressed within them.
Every effort is made to keep the website up and running smoothly. However, CSIRT-CY takes no responsibility for, and will not be liable for, the website being temporarily unavailable due to technical issues beyond our control.