Information Disclosure Archives - SSD Secure Disclosure

SSD Advisory – Linux BlueZ Information Leak and Heap Overflow

Leave a Comment / Vulnerability publication / By SSD Secure Disclosure technical team

(This advisory follows up on a presentation provided during our offensive security event in 2018 in Hong Kong – come join us at TyphoonCon – June 2019 in Seoul for more offensive security lectures and training)Vulnerabilities SummaryThe following advisory discuss about two vulnerabilities found in Linux BlueZ bluetooth module.One of the core ideas behind Bluetooth …

SSD Advisory – Linux BlueZ Information Leak and Heap Overflow Read More »

SSD Advisory – iOS/macOS Kernel task_inspect Information Leak

1 Comment / Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerabilities Summary The following advisory discusses a bug found in the kernel function task_inspect which a local user may exploit in order to read kernel memory due to an uninitialized variable. Vendor Response “Kernel: Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A local user may be …

SSD Advisory – iOS/macOS Kernel task_inspect Information Leak Read More »

SSD Advisory – Firefox Information Leak

2 Comments / Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerabilities Summary A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout. This leaks a memory address to the calling function which can be used as part of an exploit inside the sandboxed content process. Vendor Response The security …

SSD Advisory – Firefox Information Leak Read More »

SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure

2 Comments / Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerability Summary The following advisory describes an information disclosure found in the following TrendNet routers: TEW-751DR – v1.03B03 TEW-752DRU – v1.03B01 TEW733GR – v1.03B01 TRENDnet’s “N600 Dual Band Wireless Router, model TEW-751DR, offers proven concurrent Dual Band 300 Mbps Wireless N networking. Embedded GREENnet technology reduces power consumption by up to 50%. For your convenience …

SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure Read More »

SSD Advisory – Hack2Win – Cisco RV132W Multiple Vulnerabilities

1 Comment / Hack2Win, Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerabilities Summary The following advisory describes two (2) vulnerabilities found in Cisco RV132W Wireless N VPN version 1.0.1.8 The Cisco RV132W Wireless-N ADSL2+ VPN Router is “easy to use, set up, and deploy. This flexible router offers great performance and is suited for small or home offices (SOHO) and smaller deployments.” The vulnerabilities found are: …

SSD Advisory – Hack2Win – Cisco RV132W Multiple Vulnerabilities Read More »

SSD Advisory – Hotspot Shield Information Disclosure

3 Comments / Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerability Summary The following advisory describes a information disclosure found in Hotspot Shield. Hotspot Shield “provides secure and private access to a free and open internet. Enabling access to social networks, sports, audio and video streaming, news, dating, gaming wherever you are.” Credit An independent security researcher, Paulos Yibelo, has reported this vulnerability to Beyond …

SSD Advisory – Hotspot Shield Information Disclosure Read More »

SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities

3 Comments / Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerabilities Summary The following advisory describes four (4) vulnerabilities found in Livebox Fibra router version AR_LBFIBRA\_sp-00.03.04.112S. It is possible to chain the vulnerabilities into remote code execution. The “Livebox Fibra” router is “manufactured by Arcadyan for Orange and Jazztel in Spain” The vulnerabilities found in Arcadyan routers are: Unauthenticated configuration information leak Hard-coded credentials Memory …

SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities Read More »

SSD Advisory – DblTek Multiple Vulnerabilities

Leave a Comment / Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerabilities summary The following advisory describes 2 (two) vulnerabilities found in DblTek webserver. DBL is “specialized in VoIP products, especially GoIPs. We design, develop, manufacture, and sell our products directly and via distributors to customers. Our GoIP models now cover 1, 4, 8, 16, and 32-channel in order to meet the wide range of market …

SSD Advisory – DblTek Multiple Vulnerabilities Read More »

SSD安全公告–GraphicsMagick多个漏洞

1 Comment / Vulnerability publication / By SSD Secure Disclosure technical team

漏洞概要以下安全公告描述了在GraphicsMagick中发现的两个漏洞。 GraphicsMagick是“图像处理方面的瑞士军刀。基础包中的源码共有267K行(根据David A. Wheeler统计)，它提供了强大而有效的工具和库，支持读，写超过88种主要图像处理格式，包括DPX，GIF，JPEG，JPEG-2000，PNG，PDF，PNM和TIFF等重要格式。在GraphicsMagick中发现的两个漏洞是：内存信息泄露堆溢出漏洞提交者一位独立的安全研究人员Jeremy Heng（@nn_amon）和Terry Chia（Ayrx）向 Beyond Security 的 SSD 报告了该漏洞厂商响应厂商已经发布了这些漏洞的补丁(15237:e4e1c2a581d8 and 15238:7292230dd18)。获取更多信息： ftp://ftp.graphicsmagick.org/pub/GraphicsMagick/snapshots/ChangeLog.txt

SSD Advisory – GraphicsMagick Multiple Vulnerabilities

2 Comments / Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerabilities summary The following advisory describes two (2) vulnerabilities found in GraphicsMagick. GraphicsMagick is “The swiss army knife of image processing. Comprised of 267K physical lines (according to David A. Wheeler’s SLOCCount) of source code in the base package (or 1,225K including 3rd party libraries) it provides a robust and efficient collection of tools and …

SSD Advisory – GraphicsMagick Multiple Vulnerabilities Read More »

SSD Advisory – K7 Total Security Device Driver Arbitrary Memory Read

Leave a Comment / Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerability Summary The following advisory describes an Crash found in K7 Total Security. Credit An independent security researcher, Kyriakos Economou aka @kyREcon, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program Vendor response K7 has released patches to address this vulnerability – K7TotalSecurity version 15.1.0.305 CVE: CVE-2017-18019

SSD Advisory – Geneko Routers Information Disclosure

1 Comment / Vulnerability publication / By SSD Secure Disclosure technical team

Vulnerability Summary The following advisory describes an information disclosure vulnerability found in Geneko Routers version 3.18.21 Geneko GWG is “compact and cost effective communications solution that provides cellular capabilities for fixed and mobile applications such as data acquisition, smart metering, remote monitoring and management. GWG supports a variety of radio bands options on 2G, 3G …

SSD Advisory – Geneko Routers Information Disclosure Read More »

Information Disclosure

SSD Advisory – Linux BlueZ Information Leak and Heap Overflow

SSD Advisory – iOS/macOS Kernel task_inspect Information Leak

SSD Advisory – Firefox Information Leak

SSD Advisory – TrendNet AUTHORIZED_GROUP Information Disclosure

SSD Advisory – Hack2Win – Cisco RV132W Multiple Vulnerabilities

SSD Advisory – Hotspot Shield Information Disclosure

SSD Advisory – Livebox Fibra (Orange Router) Multiple Vulnerabilities

SSD Advisory – DblTek Multiple Vulnerabilities

SSD安全公告–GraphicsMagick多个漏洞

SSD Advisory – GraphicsMagick Multiple Vulnerabilities

SSD Advisory – K7 Total Security Device Driver Arbitrary Memory Read

SSD Advisory – Geneko Routers Information Disclosure

Get in touch

?

?

Get in touch