Top Linux Kernel Vulnerabilities Kali Redteaming
We must thank IT virtualization as it led us to cloud technology. Today's IT infrastructures are already running their mission critical business applications on virtual machines.
Like the physical infrastructure, virtualization is also cursed with cyber security challenges. This article talks about a typical open source virtualization solution and depicts the steps to secure its.
TOP VULNERABILITIES
Top 5 New Open Source Vulnerabilities in June 2018
This is the list of June's top 5 new known open source security vulnerabilities:
June's top 5 list of vulnerable open source components has some old favorites that many of us are probably using. Some of them were published in the NVD, but three out of the five were made public in other security advisories that many developers are probably less familiar with.
Apache Ant
WS-2018-0126
Vulnerability Score: High - 8.5
Affected versions: prior to version 1.9.12
Apache ant, the Java based build tool from one of the OGs of the free and open source community, was hit with an archive extraction vulnerability: an archive extraction issue that was disclosed this month and affects quite a few projects.
In the case of Ant, affected versions are vulnerable to a path traversal issue in archive extraction. This vulnerability could be exploited by an attacker using a specially crafted archive that holds directory traversal filenames to execute arbitrary code.
SharpZipLib
WS-2018-0142
Vulnerability Score: High - 8.5
Affected versions: prior to commit 79503293a
Zip much? Another open source project affected by the archive extraction vulnerability disclosed this month is SharpZipLib, a Zip, G-Zip, Tar and BZip2 library written entirely in C# for the .NET platform, so that users can easily incorporate it into any .NET language project.
Much like the security issue found in Ant, a file overwrite vulnerability was discovered in affected versions of SharpZipLib, that could result in a remote code execution/ file overwrite attack.
Happily, the good folks at SharpZipLib have addressed the issue and updated the project.
jackson-core
WS-2018-0125
Vulnerability Score: Medium - 5.5
Affected versions: before version 2.7.6.
This month, the hardworking folks of the jackson-core project discovered that the library is vulnerable to an "Out of Memory" error, when writing?Big Decimal while WRITE_BIGDECIMAL_AS_PLAIN setting is enabled. Attackers could exploit this issue to execute a denial of service attack.
The much beloved Jackson project is an old favorite on our monthly top 5 list, due to its huge popularity and the active community that continuously checks and updates the libraries.??
net/socket.c in the Linux kernel
Vulnerability Score: Medium - 5.5
Affected versions: through 4.17.1
A few weeks ago we shared our list of the top 5 vulnerable Linux projects to hit us in 2018 so far, and here we have another indication of how active the Linux kernel community is in addressing issues when they arise.
In this case, a NULL pointer dereference issue was discovered in the Linux kernel net/socket.c file. The vulnerability could be exploited by attackers to cause a system crash and a denial of service.
Sprockets
Vulnerability Score: Medium - 5.5
Affected versions: 4.0.0.beta7 and lower, 3.7.1 and lower, 2.12.4 and lower.
There is an information leak vulnerability in Sprockets, a Ruby library for compiling and serving web assets.
The newly discovered security vulnerability could allow specially crafted requests to be used to access files on the file system that is outside an application's root directory, if the Sprockets server is used in production.
The Sprocket community has issued a fix, and advises all users running an affected release to either upgrade or use one of the work around immediately. The advisory also strongly recommends users avoid using the Sprockets server in production.
At Valency Networks, we understand your web application and perform framework specific checks mentioned above. Our expertise in this matter enables us to be very accurate in terms of our vulnerability finding.