An 18-year-old researcher has earned more than $36,000 from Google after finding a critical remote code execution vulnerability related to the Google App Engine.
Part of the Google Cloud offering, the App Engine is a framework that allows users to develop and host web applications on a fully managed serverless platform.
http://feedproxy.google.com/~r/Securityweek/~3/8dPtymxp0nY/researcher-earns-36000-google-app-engine-flaws
The Drupal websites hacked by cybercriminals using the vulnerabilities known as Drupalgeddon2 and Drupalgeddon3 deliver cryptocurrency miners, remote administration tools (RATs) and tech support scams.
http://feedproxy.google.com/~r/Securityweek/~3/GLJhaaWRtnI/hacked-drupal-sites-deliver-miners-rats-scams
Updates announced on Friday by the Internet Systems Consortium (ISC) for BIND, the most widely used Domain Name System (DNS) software, patch a couple of vulnerabilities.
While attackers may be able to exploit both of the flaws remotely for denial-of-service (DoS) attacks, the security holes have been assigned only a “medium” severity rating.
http://feedproxy.google.com/~r/Securityweek/~3/YfEIi9BwmEk/two-vulnerabilities-patched-bind-dns-software
Enlarge (credit: Lisa Cooper / Flickr)
It’s not every day someone develops a malware attack that, with one click, exploits separate zero-day vulnerabilities in two widely different pieces of software. It’s even rarer that a careless mistake burns such a unicorn before it can be used. Researchers say that’s precisely happened to malicious PDF document designed to target unpatched vulnerabilities in both Adobe Reader and older versions of Microsoft Windows.
Modern applications typically contain “sandboxes” and other defenses that make it much harder for exploits to successfully execute malicious code on computers. When these protections work as intended, attacks that exploit buffer overflows and other common software vulnerabilities result in a simple application crash rather than a potentially catastrophic security event. The defenses require attackers to chain together two or more exploits: one executes malicious code, and a separate exploit allows the code to break out of the sandbox.
A security researcher from antivirus provider Eset recently found a PDF document that bypassed these protections when Reader ran on older Windows versions. It exploited a then-unpatched memory corruption vulnerability, known as a double free, in Reader that made it possible to gain a limited ability to read and write to memory. But to install programs, the PDF still needed a way to bypass the sandbox so that the code could run in more sensitive parts of the OS.
Read 6 remaining paragraphs | Comments
https://arstechnica.com/?p=1311677
A misconfigured server operated by CalAmp, a company offering the backend for a broad range of well-known car alarm systems, provided anyone with access to data and even allowed for account and vehicle takeover.
http://feedproxy.google.com/~r/Securityweek/~3/jJikif00LKI/misconfigured-calamp-server-enabled-vehicle-takeover
Cisco has found and patched three critical unauthorized access vulnerabilities in its Digital Network Architecture (DNA) platform.
Cisco DNA is a solution that helps enterprises automate network operations, making it easy to design, provision and apply policies across their environments.
http://feedproxy.google.com/~r/Securityweek/~3/a5S51Ivf0VA/critical-flaws-cisco-dna-center-allow-unauthorized-access
Taiwan-based industrial automation company Advantech has released an update for its WebAccess product to address nearly a dozen vulnerabilities, including critical flaws that allow arbitrary code execution.
http://feedproxy.google.com/~r/Securityweek/~3/5gct7uuOObM/critical-code-execution-flaws-patched-advantech-webaccess
Siemens informed customers on Tuesday that some of its SIMATIC S7-400 CPUs are affected by a high severity denial-of-service (DoS) vulnerability.
http://feedproxy.google.com/~r/Securityweek/~3/Re8bixLPaAk/severe-dos-flaw-discovered-siemens-simatic-plcs
Open source components have been increasingly used by developers, but failure to patch vulnerabilities in this type of software can pose serious risks.
http://feedproxy.google.com/~r/Securityweek/~3/jKAHq0xaJJQ/flaws-open-source-components-pose-increasing-risk-apps-study
An update released over the weekend for the desktop version of the privacy-focused communications app Signal patches a critical vulnerability that could have been exploited for remote code execution with no user interaction required.
http://feedproxy.google.com/~r/Securityweek/~3/yx507hjkDP4/signal-flaw-allowed-code-execution-no-user-interaction
