The Voice Of Security - News 6

Новости - Выпуск 6

Шестой подкаст освещает новости 16-22 декабря 2019 года:

1. Binary planting and arbitrary file (over)write vulnerabilities in npm, pnpm and yarn [1] [2]
2. BreakingApp – WhatsApp Crash & Data Loss Bug [3] [4]
3. Lazarus pivots to Linux attacks through Dacls Trojan [5] [6]
4. Microsoft SharePoint Server Information Disclosure Vulnerability [7] [8]
5. Privilege Escalation Flaws Found in Preinstalled Acer, ASUS Software [9] [10]
6. TP-Link Router Bug Lets Attackers Login Without Passwords [11] [12]
7. Vulnerability in Citrix Application Delivery Controller and Citrix Gateway [13] [14]


[1] - https://blog.daniel-ruf.de/critical-design-flaw-npm-pnpm-yarn/
[2] - https://xakep.ru/2019/12/16/npm-bug-2/

[3] - https://xakep.ru/2019/12/18/whatsapp-bug/
[4] - https://research.checkpoint.com/2019/breakingapp-whatsapp-crash-data-loss-bug/

[5] - https://www.zdnet.com/article/lazarus-pivots-to-linux-attacks-through-dacls-trojan/
[6] - https://threatpost.ru/lazarus-arms-up-with-dacls-trojan/35055/

[7] - https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1491
[8] - https://threatpost.ru/microsoft-issues-out-of-band-update-sharepoint-bug/35059/

[9] - https://threatpost.ru/asus-acer-fix-dangerous-vulns/35062/
[10] - https://www.securityweek.com/privilege-escalation-flaws-found-preinstalled-acer-asus-software


[11] - https://www.securitylab.ru/news/503474.php
[12] - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7405

[13] - https://support.citrix.com/article/CTX267027
[14] - https://www.anti-malware.ru/news/2019-12-19-1447/31599

Канал в телеграме: tgclick.ru/voiceofsecurity/609