TippingPoint Threat Intelligence and Zero-Day Coverage – Week of April 9, 2018

The interviewing process can be mentally draining. You have to look your best, say the right things, and prove that you’re the best person for the job. When I interview candidates, I love to come up with the one crazy question that isn’t on the usual list of questions that might be asked. I...

libreoffice/lwpfuzzer: Bad-cast to XFTextStyle from XFParaStyle in LwpFrib::RegisterStyle

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=5179243848794112 Project: libreoffice Fuzzer: libFuzzerlibreofficelwpfuzzer Fuzz target binary: lwpfuzzer Job Type: libfuzzerubsanlibreoffice Platform Id: linux Crash Type: Bad-cast Crash...

imagemagick/ping_png_fuzzer: Heap-use-after-free in read_user_chunk_callback

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=6139944834695168 Project: imagemagick Fuzzer: libFuzzerimagemagickpingpngfuzzer Fuzz target binary: pingpngfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...

DARPA Funding in AI-Assisted Cybersecurity

DARPA is launching a program aimed at vulnerability discovery via human-assisted AI. The new DARPA program is called CHESS Computers and Humans Exploring Software Security, and they're holding a proposers day in a week and a half. This is the kind of thing that can dramatically change the...

imagemagick/ping_mng_fuzzer: Use-of-uninitialized-value in Magick_RenderingIntent_from_PNG_RenderingIntent

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=6350986827268096 Project: imagemagick Fuzzer: libFuzzerimagemagickpingmngfuzzer Fuzz target binary: pingmngfuzzer Job Type: libfuzzermsanimagemagick Platform Id: linux Crash Type:...

Video Downloader Universal Cross Site Scripting

Video Downloader Extension: Universal XSS Browsing through the list of most popular Chrome extensions, I noticed this extension with 4M users: https://chrome.google.com/webstore/detail/video-downloader-professi/elicpjhcidhpjomhibiffojpinpmmpil?hl=en It has a pretty obvious universal XSS i.e. it...

wireshark/fuzzshark_udp_port-dns: Heap-buffer-overflow in add_rr_to_tree

Project: https://code.wireshark.org/review/wireshark https://gitlab.com/wireshark/wireshark.git Detailed report: https://oss-fuzz.com/testcase?key=5928838602162176 Project: wireshark Fuzzer: libFuzzerwiresharkfuzzsharkudpport-dns Fuzz target binary: fuzzsharkudpport-dns Job Type:...

graphicsmagick/coder_TIM_fuzzer: Use-of-uninitialized-value in SyncImageCallBack

Project: http://hg.code.sf.net/p/graphicsmagick/code Detailed report: https://oss-fuzz.com/testcase?key=5173489750245376 Project: graphicsmagick Fuzzer: libFuzzergraphicsmagickcoderTIMfuzzer Fuzz target binary: coderTIMfuzzer Job Type: libfuzzermsangraphicsmagick Platform Id: linux Crash Type:...

imagemagick/ping_wpg_fuzzer: Heap-buffer-overflow in SetPixelIndex

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5076244040253440 Project: imagemagick Fuzzer: libFuzzerimagemagickpingwpgfuzzer Fuzz target binary: pingwpgfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...

Z-BlogPHP Cross-Site Request Forgery Vulnerability

Z-BlogPHP is a powerful blogging program. A cross-site request forgery vulnerability exists in pluginedit.php in Z-BlogPHP 1.5.1 Zero. An attacker can exploit this vulnerability to execute arbitrary PHP code...

imagemagick/ping_webp_fuzzer: Heap-buffer-overflow in ReadWebPLSBWord

Project: https://github.com/imagemagick/imagemagick.git Detailed report: https://oss-fuzz.com/testcase?key=5114460055273472 Project: imagemagick Fuzzer: libFuzzerimagemagickpingwebpfuzzer Fuzz target binary: pingwebpfuzzer Job Type: libfuzzerasanimagemagick Platform Id: linux Crash Type:...

ots/ots-fuzzer: Crash in ots::Buffer::ReadU16

Project: https://github.com/khaledhosny/ots.git Detailed report: https://oss-fuzz.com/testcase?key=4904400788127744 Project: ots Fuzzer: libFuzzerotsots-fuzzer Fuzz target binary: ots-fuzzer Job Type: libfuzzerasanots Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x627000385430 Crash...

librawspeed/TiffDecoderFuzzer-ArwDecoder: Use-of-uninitialized-value in rawspeed::TiffIFD::TiffIFD

Project: https://github.com/darktable-org/rawspeed.git Detailed report: https://oss-fuzz.com/testcase?key=5990033396858880 Project: librawspeed Fuzzer: libFuzzerlibrawspeedTiffDecoderFuzzer-ArwDecoder Fuzz target binary: TiffDecoderFuzzer-ArwDecoder Job Type: libfuzzermsanlibrawspeed Platform Id:...

Exploit kits: Winter 2018 review

In the past, we used to do a blog series on exploit kits where we would periodically check in on the main players in the market. In March 2017, we wrote the Winter 2017 review, before exploit kit activity dropped down to a whisper. We've since discontinued our blog series, for lack of development...

libreoffice/fodsfuzzer: Heap-use-after-free in ScXMLDatabaseRangeContext::endFastElement

Project: git://anongit.freedesktop.org/libreoffice/core Detailed report: https://oss-fuzz.com/testcase?key=6030863839002624 Project: libreoffice Fuzzer: libFuzzerlibreofficefodsfuzzer Fuzz target binary: fodsfuzzer Job Type: libfuzzerasanlibreoffice Platform Id: linux Crash Type:...

dlplibs/cdrfuzzer: Stack-use-after-scope in libcdr::CDRParser::_redirectX6Chunk

Detailed report: https://oss-fuzz.com/testcase?key=5193637206949888 Project: dlplibs Fuzzer: libFuzzerdlplibscdrfuzzer Fuzz target binary: cdrfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Stack-use-after-scope READ 8 Crash Address: 0x7f8e30db6bd8 Crash State:...

eastafricanlobbyday.com XSS vulnerability

Open Bug Bounty ID: OBB-587931 Description| Value ---|--- Affected Website:| eastafricanlobbyday.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of March 19, 2018

Back in 2005, there were a number of us in a conference room in Austin, Texas working to determine how we would structure it, what we would name it, and how to deal with the potential backlash that would come after we announced it. What is it? I’m referring to our Zero Day Initiative. It’s been a...

Vulnerabilities are a Cybercriminal’s Best Friend

When discussions around the ways cybercriminals and hackers are able to compromise and penetrate an organization, it regularly leads to the use of exploits and exploit kits. Because all software can contain flaws and bugs, a threat actor only has to either find a new, undisclosed vulnerability...

A week in security (March 12 – March 18)

Last week on Malwarebytes Labs, we took a look at the inner workings of a fileless attack, explored what happened in a zero day ransomware attack aimed at South Koreans, gave you hints and tips for avoiding cold calls, and took a deep dive into the secretive world of GrayKey. Other news The Equif...