EDX-Explorer

A flaw in Safari – that allows an attacker to spoof Attack.Phishing websites and trick Attack.Phishing victims into handing over their credentials – has yet to be patched Vulnerability-related.PatchVulnerability . A browser address bar spoofing flaw was found Vulnerability-related.DiscoverVulnerability by researchers this week in Safari – and Apple has yet issue Vulnerability-related.PatchVulnerability a patch for the flaw . Researcher Rafay Baloch on Monday disclosed Vulnerability-related.DiscoverVulnerability two proof-of-concepts revealing Vulnerability-related.DiscoverVulnerability how vulnerabilities in Edge browser 42.17134.1.0 and Safari iOS 11.3.1 could be abused to manipulate the browsers ’ address bars , tricking victims into thinking they are visiting a legitimate website . Baloch told Threatpost Wednesday that Apple has promised to fix Vulnerability-related.PatchVulnerability the flaw in its next security update for Safari . “ Apple has told [ me ] that the latest beta of iOS 12 also addresses Vulnerability-related.PatchVulnerability the issue , however they haven ’ t provided any dates , ” he said . Apple did not respond to multiple requests for comment from Threatpost . Microsoft for its part has fixed Vulnerability-related.PatchVulnerability the vulnerability Baloch found Vulnerability-related.DiscoverVulnerability in the Edge browser , ( CVE-2018-8383 ) in its August Patch Tuesday release . According to Microsoft ’ s vulnerability advisory released Vulnerability-related.PatchVulnerability August 14 , the spoofing flaw exists because Edge does not properly parse HTTP content . Both flaws stem from the Edge and Safari browsers allowing JavaScript to update the address bar while the page is still loading . This means that an attacker could request data from a non-existent port and , due to the delay induced by the setInterval function , trigger the address bar spoofing . The browser would then preserve the address bar and load the content from the spoofed page , Baloch said in his blog breaking down both vulnerabilities . From there , the attacker could spoof Attack.Phishing the website , using it to lure Attack.Phishing in victims and potentially gather credentials or spread malware . For instance , the attacker could send Attack.Phishing an email message containing the specially crafted URL to the user , convince the user to click it , and take them to the link which could gather their credentials or sensitive information . “ As per Google , Address bar is the only reliable indicator for ensuring the identity of the website , if the Address bar points to Facebook.com and the content is hosted on attacker ’ s website , there is no reason why someone would not fall for this , ” Baloch told Threatpost . In a video demonstration , Baloch showed how he could visit a link for the vulnerable browser on Edge ( http : //sh3ifu [ . ] com/bt/Edge-Spoof.html ) , which would take him to a site purporting to be Attack.Phishing Gmail login . However , while the URL points to a Gmail address , the content is hosted on sh3ifu.com , said Baloch . The Safari proof-of-concept is similar , except for one constraint where it does not allow users to type their information into the input boxes while the page is in a loading state . However , Bolach said he was able to circumvent this restriction by injecting a fake keyboard using Javascript – a common practice in banking sites . No other browsers – including Chrome or Firefox – were discovered Vulnerability-related.DiscoverVulnerability to have the flaw , said Baloch . Baloch is known for discovering Vulnerability-related.DiscoverVulnerability similar vulnerabilities in Chrome , Firefox and other major browsers in 2016 , which also allowed attackers to spoof URLs in the address bar . The vulnerabilities were disclosed Vulnerability-related.DiscoverVulnerability to both Microsoft and Apple and Baloch gave both a 90-day deadline before he went public Vulnerability-related.DiscoverVulnerability with the flaws . Due to the Safari browser bug being unpatched Vulnerability-related.PatchVulnerability , Baloch said he has not yet released a Proof of Concept : “ However considering there is a slight difference between the Edge browser POC and Safari , anyone with decent knowledge of Javascript can make it work on Safari , ” he told us .

This week , Adobe released Vulnerability-related.PatchVulnerability its monthly scheduled update bundle addressing Vulnerability-related.PatchVulnerability vulnerabilities within its different products . The Adobe patch Tuesday November updates allegedly fixed Vulnerability-related.PatchVulnerability numerous vulnerabilities leading to information disclosure . These vulnerabilities existed in Vulnerability-related.DiscoverVulnerability Adobe Acrobat/Reader , Flash Player , and Photoshop CC . The recently released Adobe Patch Tuesday November updates addressed Vulnerability-related.PatchVulnerability three different vulnerabilities – all resulting in information disclosure . The first one existed in Vulnerability-related.DiscoverVulnerability the Adobe Photoshop CC affecting Vulnerability-related.DiscoverVulnerability versions 19.1.6 and prior for both Windows and MacOS . As described in the security advisory , Adobe has fixed Vulnerability-related.PatchVulnerability this important Out-of-bounds read vulnerability ( CVE-2018-15980 ) in the Photoshop CC versions 19.1.7 and 20.0 . The second information disclosure flaw affected Vulnerability-related.DiscoverVulnerability Adobe Reader and Acrobat for Windows . Explaining about the flaw in their advisory , Adobe stated , “ Successful exploitation could lead to an inadvertent leak of the user ’ s hashed NTLM password. ” The vulnerability initially received the CVE Vulnerability-related.DiscoverVulnerability number CVE-2018-4993 , when Check Point Research first reported Vulnerability-related.DiscoverVulnerability the bug . However , as recently disclosed Vulnerability-related.DiscoverVulnerability by the EdgeSpot , Adobe only patched Vulnerability-related.PatchVulnerability a single variant of this bug . Whereas , the EdgeSpot team discovered Vulnerability-related.DiscoverVulnerability other variants that hinted towards a failed patching Vulnerability-related.PatchVulnerability of the bug instead of a new vulnerability . The patched vulnerability has now received CVE Vulnerability-related.DiscoverVulnerability number CVE-2018-15979 “ to reflect that the patch is available Vulnerability-related.PatchVulnerability ” . The third vulnerability addressed Vulnerability-related.PatchVulnerability this month is an out-of-bounds Read vulnerability ( CVE-2018-15978 ) in the Adobe Flash Player . The affected versions include 31.0.0.122 and earlier for Windows , Linux , and MacOS . Unlike previous months , the Adobe Patch Tuesday November update bundle addressed Vulnerability-related.PatchVulnerability fewer bugs . Moreover , none of the patched vulnerabilities had a critical severity impact . In October , Adobe patched Vulnerability-related.PatchVulnerability 86 different vulnerabilities including 47 critical ones . Whereas , in September , they addressed Vulnerability-related.PatchVulnerability 6 critical flaws . Adobe has fixed Vulnerability-related.PatchVulnerability the bugs CVE-2018-15980 and CVE-2018-15978 in Adobe Photoshop CC versions 19.1.7 and 20.0 and Adobe Flash Player version 31.0.0.148 , respectively . Whereas , CVE-2018-15979 has received Vulnerability-related.PatchVulnerability a patch in Adobe Acrobat DC and Reader DC version 2019.008.20081 , Acrobat 2017 and Acrobat Reader DC 2017 version 2017.011.30106 , and Acrobat DC and Acrobat Reader DC ( Classic 2015 ) version 2015.006.30457 . For protection against the three important vulnerabilities addressed Vulnerability-related.PatchVulnerability in November updates , users should make sure to upgrade Vulnerability-related.PatchVulnerability their software to the patched versions at the earliest convenience .

11th December was Microsoft ’ s December 2018 Patch Tuesday , which means users had to update Vulnerability-related.PatchVulnerability their computers to be protected from the latest threats to Windows and Microsoft products . Microsoft has fixed Vulnerability-related.PatchVulnerability 39 vulnerabilities , with 10 of them being labeled as Critical . Keeping up with its December 2018 Patch Tuesday , Microsoft announced Vulnerability-related.DiscoverVulnerability on its blog that a vulnerability exists in Vulnerability-related.DiscoverVulnerability Windows Domain Name System ( DNS ) . There was not much information provided to the customers about how and when this vulnerability was discovered Vulnerability-related.DiscoverVulnerability . The following details were released by Microsoft : The Exploit Microsoft Windows is prone Vulnerability-related.DiscoverVulnerability to a heap-based buffer-overflow vulnerability . A remote code execution vulnerability exists in Vulnerability-related.DiscoverVulnerability Windows Domain Name System ( DNS ) servers when they fail to properly handle requests . An attacker who successfully exploits Vulnerability-related.DiscoverVulnerability this issue may execute arbitrary code within the context of the affected application . Microsoft states that failed exploit attempts will result in a denial-of-service condition . Windows servers that are configured as DNS servers are at risk from this vulnerability . Affected Systems Find a list of the affected systems on Microsoft ’ s Blog . The company has also provided Vulnerability-related.PatchVulnerability users with security updates for the affected systems . Workarounds and Mitigations As of today , Microsoft has not identified any workarounds or mitigations for the affected systems . Jake Williams , the founder of Rendition Security and Rally security , posted an update on Twitter about the issue , questioning why there is no sufficient discussion among the infosec community about the matter .

Mozilla has recently fixed Vulnerability-related.PatchVulnerability multiple security flaws in its Thunderbird 60.3 email client . These vulnerabilities also include a critical security bug that allegedly affected Vulnerability-related.DiscoverVulnerability Mozilla ’ s Firefox and Firefox ESR browsers as well . Last week , Mozilla patched Vulnerability-related.PatchVulnerability multiple security flaws altogether in its latest Thunderbird 60.3 including a critical security flaw . As explained in Mozilla ’ s security advisory , numerous community members and developers at Mozilla discovered Vulnerability-related.DiscoverVulnerability reported memory safety bugs that only affected Vulnerability-related.DiscoverVulnerability Thunderbird email client , but also had impacted Vulnerability-related.DiscoverVulnerability Firefox and Firefox ESR . Describing the bugs ( CVE-2018-12390 ) , Mozilla stated , Some of these bugs showed evidence of memory corruption and we presume that with enough effort that some of these could be exploited Vulnerability-related.DiscoverVulnerability to run arbitrary code . Mozilla has fixed Vulnerability-related.PatchVulnerability the bugs in Firefox 63 , Firefox ESR 60.3 , and Thunderbird 60.3 respectively . Apart from the critical memory safety bugs , Mozilla also released Vulnerability-related.PatchVulnerability fixes for several other vulnerabilities affecting Vulnerability-related.DiscoverVulnerability Thunderbird . These include three vulnerabilities with a high severity level , and low severity level memory safety bugs ( CVE-2018-12389 ) . The three high severity flaws include : CVE-2018-12391 : HTTP Live Stream audio data accessible cross-origin ( affected Firefox for Android only ) . The bug could allow accessing audio data across origins during HTTP live stream playback on the Firefox browser for Android . CVE-2018-12392 : Crash with nested event loops . An attacker could trigger an exploitable crash by exploiting the bug . CVE-2018-12393 : Integer overflow during Unicode conversion while loading JavaScript . This out-of-bounds write vulnerability only affected 32-bit builds . With regards to the conditions for the exploit , Mozilla elaborated , In general , these flaws can not be exploited Vulnerability-related.DiscoverVulnerability through email in the Thunderbird product because scripting is disabled when reading mail , but are potentially risks in browser or browser-like contexts . Mozilla patched Vulnerability-related.PatchVulnerability multiple vulnerabilities in the previous versions of Thunderbird and Firefox last month . That time too , Mozilla released Vulnerability-related.PatchVulnerability a fix for critical code execution vulnerability affecting Vulnerability-related.DiscoverVulnerability Thunderbird 60.2 , Firefox 61 and Firefox ESR 60.1 .

US Postal Service website flaw was patched Vulnerability-related.PatchVulnerability this week but reported Vulnerability-related.DiscoverVulnerability by a security researcher a year ago . The US Postal Service has fixed Vulnerability-related.PatchVulnerability a security bug in its website that allowed anyone with an account to see the account details of the site 's 60 million users . The flaw was patched Vulnerability-related.PatchVulnerability this week after USPS was informed Vulnerability-related.DiscoverVulnerability of the issue by Krebs on Security , which reports that an unnamed independent researcher reported Vulnerability-related.DiscoverVulnerability the bug a year ago but never received a response . According to Krebs , the flaw was caused by an authentication weakness in the application programming interface ( API ) on usps.com that supported the USPS 'Informed Visibility ' program , which offers business customers `` near real-time tracking data '' about mail campaigns and packages . The bug let anyone who was logged in to usps.com to see account details for others users , including email address , username , user ID , account number , street address , phone number , authorized users , mailing campaign data and more . Krebs notes that the `` API also let any user request account changes for any other user , such as email address , phone number or other key details '' . USPS said in a statement it had no information that the vulnerability had been used to access customer records . `` Computer networks are constantly under attack Attack.Databreach from criminals who try to exploit vulnerabilities to illegally obtain Attack.Databreach information . Similar to other companies , the Postal Service 's Information Security program and the Inspection Service uses industry best practices to constantly monitor our network for suspicious activity , '' USPS said . `` Any information suggesting criminals have tried to exploit potential vulnerabilities in our network is taken very seriously . Out of an abundance of caution , the Postal Service is further investigating to ensure that anyone who may have sought to access our systems inappropriately is pursued to the fullest extent of the law . '' However , a recent vulnerability assessment of the Informed Visibility program by the Office of Inspector General of the US Postal Service turned up weaknesses , including a lack of audit logs , in the Informed Visibility database . The partially redacted audit report , published in October , assessed 13 Informed Visibility ( IV ) servers . It found overall compliance with Postal Service server configuration baselines , but weakness in the IV database 's account-management systems . `` We identified weaknesses in account management controls , specifically with password complexity , disabling user accounts , and maintaining audit logs , '' the OIG report notes . `` Without account management controls , the IV system is at risk for [ redacted ] . Further , if expired accounts are not disabled in a timely manner , this increases the duration that Postal Service information resources are vulnerable to compromise . `` Additionally , without audit logs , the Postal Service would not be able to obtain sufficient detail to reconstruct activities in the event of a compromise or malfunction '' . USPS has faced scrutiny in the past , after a 2014 hack exposed Attack.Databreach personal information on 800,000 employees , 485,000 workers ' compensation records , and 2.9 million customer-inquiry records . The OIG in 2015 criticized the USPS for focusing on compliance and failing to foster a `` culture of effective cybersecurity across the enterprise '' .

A new iPhone and a new iOS are here , but a number of bugs , and security flaws , have frustrated early adopters . iOS 12.0.1 , Apple 's first update after the release of iOS 12 , has patched Vulnerability-related.PatchVulnerability two vulnerabilities that could have allowed a user to bypass a device 's passcode . Spanish hacker Jose Rodriguez was able to use Siri to enable VoiceOver mode , which could pull up the phone 's contacts . You can see the specifics of his ( very complicated ) procedure in the video below . Apple also says it has fixed Vulnerability-related.PatchVulnerability a bug that caused the new iPhones to stop charging when their screens turned off . This was n't an issue our review unit had , but it was noted throughout multiple forums and message boards . The company has fixed Vulnerability-related.PatchVulnerability a number of smaller bugs as well . A bug that caused the phone to automatically join 2.4-GHz networks rather than 5 GHz networks , a bug that sometimes caused Bluetooth to become unavailable , and a bug that blocked subtitles from appearing in some video apps are no longer . iPad users were n't left out , either . To some users ' chagrin , the original iOS 12 moved the `` 123 '' key closer to the center of the iPad keyboard . You can breathe easy again : The key has moved back to the far left . The update should be available Vulnerability-related.PatchVulnerability to all users now . If you do n't have automatic updates enabled , we recommend you update Vulnerability-related.PatchVulnerability to the new patch ASAP if you 've experienced any of these flaws , or are worried about hackers obtaining your phone .

Researchers have discovered Vulnerability-related.DiscoverVulnerability some serious security flaws threatening Linux . These vulnerabilities exist in Vulnerability-related.DiscoverVulnerability Linux systemd component . According to the researchers , the vulnerabilities pose a risk to all systemd-based Linux distros . Allegedly , researchers at Qualys have disclosed Vulnerability-related.DiscoverVulnerability some bugs targeting the Linux systemd component . Systemd provides the core building blocks for Linux and handles major processes after booting . As revealed Vulnerability-related.DiscoverVulnerability , three vulnerabilities have targeted the systemd-journald , which is responsible for data collection and log storage . The vulnerabilities let an attacker gain root privileges on the target device . The researchers state Vulnerability-related.DiscoverVulnerability that these vulnerabilities threaten all Linux distros based on systemd except a few . As stated in their report , “ To the best of our knowledge , all systemd-based Linux distributions are vulnerable Vulnerability-related.DiscoverVulnerability , but SUSE Linux Enterprise 15 , openSUSE Leap 15.0 , and Fedora 28 and 29 are not exploitable because their user space is compiled with GCC ’ s -fstack-clash-protection. ” The three bugs include two different memory corruption flaws ( CVE-2018-16864 and CVE-2018-16865 ) , and an out-of-bounds flaw ( CVE-2018-16866 ) . At first , the researchers accidentally discovered Vulnerability-related.DiscoverVulnerability CVE-2018-16864 while working on an exploit for a previously disclosed vulnerability , Mutagen Astronomy . Then , when they were busy on its PoC , they spotted Vulnerability-related.DiscoverVulnerability the other two bugs . “ We developed Vulnerability-related.DiscoverVulnerability a proof of concept for CVE-2018-16864 that gains eip control on i386… We developed Vulnerability-related.DiscoverVulnerability an exploit for CVE-2018-16865 and CVE-2018-16866 that obtains a local root shell in 10 minutes on i386 and 70 minutes on amd64 , on average. ” Interestingly , the bugs had been around for quite a few years . For now , Red Hat has patched Vulnerability-related.PatchVulnerability the bugs CVE-2018-16864 and CVE-2018-16865 . Whereas , Debian has fixed Vulnerability-related.PatchVulnerability CVE-2018-16866 in the unstable systemd 240-1 release . Other distros will also supposedly release Vulnerability-related.PatchVulnerability the fixes soon . In November 2018 , a Google researcher also highlighted Vulnerability-related.DiscoverVulnerability a critical flaw in Systemd that induced system crashes and hacks .

This week , Adobe has released Vulnerability-related.PatchVulnerability its very first Patch Tuesday update bundle for the year 2019 . The Adobe January Patch Tuesday updates brought fixes for security vulnerabilities in Adobe Digital Editions and Adobe Connect . It has also released Vulnerability-related.PatchVulnerability patches for Flash Player , but they are not security fixes . This Tuesday , Adobe has rolled-out Vulnerability-related.PatchVulnerability scheduled monthly updates for its products . However , this time , it has particularly focused on Adobe Digital Editions and Adobe Connect for security fixes . Besides , the update bundle is relatively smaller , unlike the previous updates that addressed Vulnerability-related.PatchVulnerability tens of vulnerabilities . According to the security advisory , Adobe has fixed Vulnerability-related.PatchVulnerability an important security vulnerability in Adobe Digital Editions . Describing the problem , they stated , “ Successful exploitation could lead to information disclosure in the context of the current user. ” Reportedly , it ’ s an out of bounds read flaw ( CVE-2018-12817 ) that affected Vulnerability-related.DiscoverVulnerability the software version 4.5.9 and earlier for all platforms , i.e. , Windows , MacOS , Android and iOS . Users should ensure updating Vulnerability-related.PatchVulnerability their devices with the patched Adobe Digital Editions version 4.5.10 . In addition to the above , another important vulnerability existed in Vulnerability-related.DiscoverVulnerability Adobe Connect that could result in session token exposure . As stated in the advisory , the vulnerability ( CVE-2018-19718 ) could “ lead to exposure of privileges granted to a session. ” The vulnerability affected Vulnerability-related.DiscoverVulnerability the Adobe Connect versions 9.8.1 and earlier for all platforms . Users should , hence , ensure updating Vulnerability-related.PatchVulnerability their systems with the patched version 10.1 . Besides the two security fixes , Adobe have released Vulnerability-related.PatchVulnerability patches for Flash Player as well addressing Vulnerability-related.PatchVulnerability performance issues . As described in the Adobe advisory , “ Adobe has released Vulnerability-related.PatchVulnerability updates for Adobe Flash Player for Windows , macOS , Linux and Chrome OS . These updates address Vulnerability-related.PatchVulnerability feature and performance bugs , and do not include security fixes. ” The patched Flash Player version 32.0.0.114 has been rolled-out to be downloaded Vulnerability-related.PatchVulnerability across all platforms . This time , the update bundle did not address Vulnerability-related.PatchVulnerability security problems in Adobe Reader or Acrobat . However , the vendors already released Vulnerability-related.PatchVulnerability security fixes for them in the previous week . The patch addressed Vulnerability-related.PatchVulnerability two critical vulnerabilities ( CVE-2018-16011 and CVE-2018-16018 ) that could result in arbitrary code execution and privilege escalation respectively .

ENTERPRISE-FOCUSED communication platform Fuze has fixed Vulnerability-related.PatchVulnerability a security vulnerability that allowed anyone to access and download recorded meetings on the platform without password authentication . The flaw was discovered Vulnerability-related.DiscoverVulnerability towards the end of February by Samuel Huckins of security company Rapid7 , and Fuze had disabled Vulnerability-related.DiscoverVulnerability access to recorded meetings by the beginning of March . An update to version 4.3.1 of the Fuze platform on March 10 rectified Vulnerability-related.PatchVulnerability the issue . `` Security is a top priority for Fuze and we appreciate Rapid7 identifying Vulnerability-related.DiscoverVulnerability this issue and bringing it to our attention . When we were informed Vulnerability-related.DiscoverVulnerability by the Rapid7 team of the issue , we took immediate action and have resolved Vulnerability-related.PatchVulnerability the problem , '' Fuze said in a statement . The vulnerability was caused by the way in which the platform incrementally added digits to the URL of recorded meetings , which resulted in relatively easy brute-force attacks proving successful . Combining the simple ability to guess URLs by inputting seven digit numbers with no requirement for authentication was always going to bring the potential for disaster , though there 's no suggestion that anyone with nefarious intent accessed any of the meetings . `` Recorded Fuze meetings are saved to Fuze 's cloud hosting service . They could be accessed by URLs such as 'https : //browser.fuzemeeting.com/ ? replayId=7DIGITNUM ' , where '7DIGITNUM ' is a seven digit number that increments over time , '' Rapid7 explains . `` Since this identifier did not provide sufficient keyspace to resist bruteforcing , specific meetings could be accessed and downloaded by simply guessing a replay ID reasonably close to the target , and iterating through all likely seven digit numbers . This format and lack of authentication also allowed one to find recordings via search engines such as Google . ''

Data: CASIE

Trigger word: has fixed

Event Types (Count): Vulnerability-related.PatchVulnerability (11)

Negative Trigger