[B! vulnerability] pugleeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

puglee id:puglee

vulnerabilityã«é–¢ã™ã‚‹pugleeã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Log4jã®æ·±åˆ»ãªè„†å¼±æ€§CVE-2021-44228ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
2021å¹´12æœˆ10æ—¥ã€Javaãƒ™ãƒ¼ã‚¹ã®ãƒã‚°å‡ºåŠ›ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€ŒApache Log4jã€ã®2.xç³»ãƒãƒ¼ã‚¸ãƒ§ãƒ³ï¼ˆä»¥é™ã¯Log4j2ã¨è¨˜è¼‰ï¼‰ã§ç¢ºèªã•ã‚ŒãŸæ·±åˆ»ãªè„†å¼±æ€§ã‚’ä¿®æ£ã—ãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒå…¬é–‹ã•ã‚Œã¾ã—ãŸã€‚ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£é–¢ä¿‚çµ„ç¹”ã§ã¯éŽåŽ»è©±é¡Œã«ãªã£ãŸHeartbleedã‚„Shellshockã¨åŒãƒ¬ãƒ™ãƒ«ã®è„†å¼±æ€§ã¨ã‚‚è©•ä¾¡ã—ã¦ã„ã¾ã™ã€‚ã“ã“ã§ã¯é–¢é€£ã™ã‚‹æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ ï¼‘ï¼Žä½•ãŒèµ·ããŸã®ï¼Ÿ Javaãƒ™ãƒ¼ã‚¹ã®ãƒã‚°å‡ºåŠ›ãƒ©ã‚¤ãƒ–ãƒ©ãƒªLog4j2ã§æ·±åˆ»ãªè„†å¼±æ€§ï¼ˆCVE-2021-44228ï¼‰ã‚’ä¿®æ£ã—ãŸãƒãƒ¼ã‚¸ãƒ§ãƒ³ãŒå…¬é–‹ã•ã‚ŒãŸã€‚ãã®å¾Œã‚‚ä¿®æ£ãŒä¸å®Œå…¨ã§ã‚ã£ãŸã“ã¨ãªã©ã‚’ç†ç”±ã«2ä»¶ã®è„†å¼±æ€§ãŒä¿®æ£ã•ã‚ŒãŸã€‚ åºƒãåˆ©ç”¨ã•ã‚Œã¦ã„ã‚‹ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã§ã‚ã‚‹ãŸã‚å½±éŸ¿ã‚’å—ã‘ã‚‹å¯¾è±¡ãŒå¤šãå˜åœ¨ã™ã‚‹ã¨ã¿ã‚‰ã‚Œã€æ”»æ’ƒãŒå®¹æ˜“ã§ã‚ã‚‹ã“ã¨ã‹ã‚‰2014å¹´ã®Heartbleedã€Shellshockä»¥æ¥ã®å±é™ºæ€§ãŒã‚ã‚‹ã¨ã¿ã‚‹å‘ãã‚‚ã‚ã‚Šã€The Apache Software
puglee 2021/12/13
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Java

apache

vulnerability

*ã‚ã¨ã§èªã‚€
ãƒªãƒ³ã‚¯
OS X 10.10 DYLD_PRINT_TO_FILE Local Privilege Escalation Vulnerability
OS X 10.10 DYLD_PRINT_TO_FILE Local Privilege Escalation Vulnerability The DYLD_PRINT_TO_FILE environment variable can be used for local privilege escalation in OS X Yosem ite. Introduction With the release of OS X 10.10 Apple added some new features to the dynamic linker dyld. One of these features is the new environment variable DYLD_PRINT_TO_FILE that enables error logging to an arbitrary file.
puglee 2015/07/24
Yosemite ã‚ˆã‚Šå¤ã‘ã‚Œã°å¤§ä¸ˆå¤«ã¨è¨€ã†ã“ã¨ã‹

OS X

vulnerability
ãƒªãƒ³ã‚¯
Bash specially-crafted environment variables code injection attack
This article was originally published on the Red Hat Customer Portal. The information may no longer be current. Update 2014-09-30 19:30 UTC Questions have arisen around whether Red Hat products are vulnerable toÂ CVE-2014-6277Â andÂ CVE-2014-6278.Â We have determined thatÂ RHSA-2014:1306,Â RHSA-2014:1311,Â andÂ RHSA-2014:1312Â successfully mitigate the vulnerability and no additional actions need to be ta
puglee 2014/09/25
bash

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Linux

security

RedHat

vulnerability

è„†å¼±æ€§
ãƒªãƒ³ã‚¯
BASHã®è„†å¼±æ€§ã§CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã«ã‚¢ãƒ¬ã•ã›ã¦ã¿ã¾ã—ãŸ
ç’°å¢ƒå¤‰æ•°ã«ä»•è¾¼ã¾ã‚ŒãŸã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã—ã¦ã—ã¾ã†BASHã®è„†å¼±æ€§ãŒ CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã«å½±éŸ¿ã‚’ä¸Žãˆã‚‹ã‹è©¦ã—ã¦ã¿ãŸã‚‰çµæžœã¯æ‚²æƒ¨ãªæ„Ÿã˜ã« Tweet 2014å¹´9æœˆ25æ—¥ å¶‹ç”°å¤§è²´ ã“ã®è¨˜äº‹ã¯2014å¹´ã®ã‚‚ã®ã§ã™ æœã‹ã‚‰ Bash specially-crafted environment variables code injection attack ãªã‚‹ã‚‚ã®ã§é¨’ãŽã«ãªã£ã¦ã„ãŸã®ã§ã€ã•ã£ããæ‰‹å…ƒã® Apacheã§è©¦ã—ã¦ã¿ã¾ã—ãŸã€‚ /hoge.cgiã¨ã„ã†URIã§å®Ÿè¡Œã•ã‚Œã‚‹ã‚ˆã†ã«ã€ä¸€è¡Œã®ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ã‚’å‡ºåŠ›ã™ã‚‹ã ã‘ã® CGIã‚¹ã‚¯ãƒªãƒ—ãƒˆã‚’è¨ç½®ã—ã¾ã™ã€‚ã„ã£ã‘ã‚“ã€ãªã‚“ã®å…¥åŠ›ã‚‚ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆå´ã‹ã‚‰å—ã‘ä»˜ã‘ã¦ã„ãªã„ãŸã‚å±é™ºã®ã‚ã‚Šã‚ˆã†ã‚‚ãªãè¦‹ãˆã¾ã™ã€‚ #!/bin/sh echo "Content-type: text/plain" echo echo "Hi! I'm an ordinary CGI script w
puglee 2014/09/25
æ—¢ã«å„ç¨®OSã§ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã‚‹ãƒ‘ãƒƒãƒã‚’æ—©ãé©ç”¨ã™ã‚‹ã®ãŒç„¡é›£ã‹ï¼Ÿ

CGI

ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£

Linux

bash

CVE-2014-6271

vulnerability

è„†å¼±æ€§

security
ãƒªãƒ³ã‚¯
1