TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 19, 2017

Yesterday I celebrated my 29th birthday again and it was great to celebrate with friends, family, and coworkers. They say age is just a number, and I truly believe that. Unfortunately, we live in a world where laws require us to count numbers so that it can be determined if we can vote, drink, re...

The Inside Scoop on the World’s Leading Bug Bounty Program

Within the security researcher community, the Zero Day Initiative ZDI program is a well-known entity, representing the world’s largest vendor agnostic bug bounty program. Customers of the TippingPoint Intrusion Prevention Systems IPS and Threat Protection Systems TPS know the ZDI as the group tha...

Unrar VMSF_DELTA Arbitrary Memory Write

VMSFDELTA filter in unrar allows arbitrary memory write It appears that the VMSFDELTA memory corruption that was reported to Sophos AV in 2012 and fixed there was actually inherited from upstream unrar. For unknown reasons, whoever fixed the bug did not report this to upstream unrar, and the bug...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 12, 2017

“What can you sit on, sleep on, and brush your teeth with?” This was the question posed to Steve Martin’s character C.D. Bales in the 1987 movie Roxanne. In a modern take of Edmond Rostand's 1897 verse play Cyrano de Bergerac, the movie centers around C.D.’s attempt to win the love of a woman whi...

Ransomware Attack Hobbles Prestigious University College London

University College London, one of the U.K.’s prestigious public research universities, has closed off access to personal and shared drives after a ransomware attack was detected late Wednesday afternoon. University officials said this morning that this was a web-based infection, reversing claims...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of June 5, 2017

This week marked the first time an airline misplaced my bags for a significant period of time. Inclement weather forced me to not only change my flight, but also change airlines. Unfortunately, my luggage didn’t get the memo. I dealt with two airlines to find my bags, and I eventually received my...

First-Ever Data Stealing Malware Found Using Intel AMT Tool to Bypass Firewall

It's not hard for a well-funded state-sponsored hacking group to break into corporate networks and compromise systems with malware, but what's challenging for them is to keep that backdoor and its communication undetectable from a firewall and other network monitoring applications. However, a...

How vulnerability research benefits both vendors and customers

Zero-day vulnerabilities - newly discovered exploits that haven't been previously identified - are now emerging more often. Worse still is the fact that these dangerous flaws sometimes aren't pinpointed until hackers have already exploited them. According to a prediction from Cybersecurity Ventur...

Man Accidentally Destroyed Production Database on First Day of His Job

By Waqas We all make mistakes, but some mistakes are fatal ending up with devastating consequences just like one of those Amazon engineers whos typo error caused a major service outage worldwide. But then theres this man /cscareerthrowaway567 who recently posted on Reddit explaining that he...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of May 29, 2017

“Anything that can go wrong will go wrong.” It’s not exactly clear how Murphy’s Law originated, but it seems to always make an appearance at the one time you can’t afford for anything to go wrong. Your laptop starts to malfunction right as you need to finish a project this happened to yours truly...

gdal: Index-out-of-bounds in DDFSubfieldDefn::ExtractFloatData

Detailed report: https://oss-fuzz.com/testcase?key=4881496894603264 Project: gdal Fuzzer: libFuzzergdalsrpfuzzer Fuzz target binary: srpfuzzer Job Type: libfuzzerubsangdal Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State: DDFSubfieldDefn::ExtractFloatData...

ffmpeg: Index-out-of-bounds in ff_hevc_decode_short_term_rps

Detailed report: https://oss-fuzz.com/testcase?key=6209288450080768 Project: ffmpeg Fuzzer: libFuzzerffmpegAVCODECIDHEVCfuzzer Fuzz target binary: ffmpegAVCODECIDHEVCfuzzer Job Type: libfuzzerubsanffmpeg Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

gdal: Heap-buffer-overflow in revmemcpy

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=6674505617375232 Project: gdal Fuzzer: libFuzzergdalfilesystemfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x6050000035b5 Crash State:...

gdal: Heap-buffer-overflow in RMFDataset::Open

Project: https://github.com/OSGeo/gdal.git Detailed report: https://oss-fuzz.com/testcase?key=5381896823373824 Project: gdal Fuzzer: libFuzzergdalfilesystemfuzzer Job Type: libfuzzerasangdal Platform Id: linux Crash Type: Heap-buffer-overflow READ 4 Crash Address: 0x60300000b8e8 Crash State:...

ShadowBrokers Put Price on Monthly Zero Day Leaks

The threat posed by the first wave of ShadowBrokers leaks of Equation Group hacking tools was relatively benign. Some vendors had to scramble to patch zero days in older versions of products, but for the most part, the leaks and accompanying auction were more of a novelty. That obviously changed...

dlplibs: Heap-buffer-overflow in MsWksDBParser::readFormula

Detailed report: https://oss-fuzz.com/testcase?key=5753657637208064 Project: dlplibs Fuzzer: libFuzzerdlplibsclariswksfuzzer Fuzz target binary: clariswksfuzzer Job Type: libfuzzerasandlplibs Platform Id: linux Crash Type: Heap-buffer-overflow READ 1 Crash Address: 0x62e00000bd99 Crash State:...

Shadow Brokers Launches 0-Day Exploit Subscriptions for $21,000 Per Month

As promised to release more zero-days exploits and hacking tools for various platforms starting from June 2017, the infamous hacking group Shadow Brokers is back with more information on how to subscribe and become a private member for receiving exclusive access to the future leaks. The Shadow...

wget2: Heap-buffer-overflow in getContent

Project: https://gitlab.com/gnuwget/wget2.git Detailed report: https://oss-fuzz.com/testcase?key=5103826937839616 Project: wget2 Fuzzer: aflwget2libwgetmetalinkparsefuzzer Fuzz target binary: libwgetmetalinkparsefuzzer Job Type: aflasanwget2 Platform Id: linux Crash Type: Heap-buffer-overflow REA...

TippingPoint Threat Intelligence and Zero-Day Coverage – Week of May 22, 2017

For those of you who follow the National Football League NFL, do you remember Super Bowl 47? I wasn’t exactly thrilled about the teams that played since I’m not a 49ers or Ravens fan. What was interesting about the game is that it was halted for over half an hour in the third quarter because of a...

WebKit Patch #1110 Universal Cross Site Scripting

WebKit: UXSS: the patch of 1110 made another bug Here's the patch of 1110. https://trac.webkit.org/changeset/212218/trunk/Source/WebCore/dom/ContainerNode.cpp void ContainerNode::parserRemoveChildNode& oldChild disconnectSubframesIfNeededthis, DescendantsOnly; d = document.querySelector'div'; p =...