Collaborate Disseminate
Quarkslab has researched and reported multiple vulnerabilities affecting Broadcom WiFi drivers. Vulnerabilities in the open source brcmfmac driver: CVE-2019-9503:If the brcmfmac driver receives a firmware event frame from a remote source,the is_wlc_eve… Continue reading VU#166939: Broadcom WiFi chipset drivers contain multiple vulnerabilities
CERT continues to review the WPA3 protocol in support of this body of research. The root cause of the numerous”implementation”vulnerabilities may involve modifying the protocol. WPA3 uses Simultaneous Authentication of Equals(SAE),also known as Dragonf… Continue reading VU#871675: WPA3 design issues and implementation vulnerabilities in hostapd and wpa_supplicant
Virtual Private Networks(VPNs)are used to create a secure connection with another network over the internet. Multiple VPN applications store the authentication and/or session cookies insecurely in memory and/or log files. CWE-311:Missing Encryption of … Continue reading VU#192371: VPN applications insecurely store session cookies
MyCar is a small aftermarket telematics unit from AutoMobility Distribution Inc. MyCar add smartphone-controlled geolocation,remote start/stop and lock/unlock capabilities to a vehicle with a compatible remote start unit. The MyCar Controls mobile appl… Continue reading VU#174715: MyCar Controls uses hard-coded credentials
A presentation at the ZeroNights 2018 conference describes multiple security issues with Marvell Avastar SoCs(models 88W8787,88W8797,88W8801,88W8897,and 88W8997). The presentation provides some detail about a block pool memory overflow. During Wi-Fi ne… Continue reading VU#730261: Marvell Avastar wireless SoCs have multiple vulnerabilities
Microsoft Exchange supports a API called Exchange Web Services(EWS). One of the EWS API functions is called PushSubscriptionRequest,which can be used to cause the Exchange server to connect to an arbitrary website. Connections made using the PushSubscr… Continue reading VU#465632: Microsoft Exchange server 2013 and newer are vulnerable to NTLM relay attacks
CWE-122:Heap-based Buffer Overflow – CVE-2018-8626 Microsoft Windows Domain Name System(DNS)servers are vulnerable to heap overflow attacks. Microsoft acknowledges that”an attacker who successfully exploited the vulnerability could run arbitrary code i… Continue reading VU#531281: Microsoft Windows DNS servers are vulnerable to heap overflow
CWE-362:Concurrent Execution using Shared Resource with Improper Synchronization(‘Race Condition’)- CVE-2018-8611 According to Microsoft,the Windows kernel fails”to properly handle objects in memory”. A successful attacker could run arbitrary code in k… Continue reading VU#289907: Microsoft Windows Kernel Transaction Manager (KTM) is vulnerable to a race condition
The Microsoft Windows MsiAdvertiseProduct function allows a Windows installer product to generate a script to advertise a product to Windows,which handles shortcut and registry information associated with an installed application. The MsiAdvertiseProdu… Continue reading VU#228297: Microsoft Windows MsiAdvertiseProduct function vulnerable to privilege escalation via race condition
CWE-121:Stack-based Buffer Overflow – CVE-2018-5410 Dokan,versions between 1.0.0.5000 and 1.2.0.1000,are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrar… Continue reading VU#741315: Dokan file system driver contains a stack-based buffer overflow