#faq
Key Reinstallation Attacks Breaking WPA2 by forcing nonce reuse Discovered by Mathy Vanhoef of imec-DistriNet, KU Leuven, 2017 Introduction We discovered serious weaknesses in WPA2, a protocol that secures all modern protected Wi-Fi networks. An attacker within range of a victim can exploit these weaknesses using key reinstallation attacks (KRACKs). Concretely, attackers can use this novel attack
JVNVU#95402108: ISC BIND ã«ã‚µãƒ¼ãƒ“スé‹ç”¨å¦¨å®³ (DoS) ã®è„†å¼±æ€§
BIND 9.0.0 ã‹ã‚‰ 9.8.8 ã¾ã§ BIND 9.9.0 ã‹ã‚‰ 9.9.8-P3 ã¾ã§ BIND 9.9.3-S1 ã‹ã‚‰ 9.9.8-S5 ã¾ã§ BIND 9.10.0 ã‹ã‚‰ 9.10.3-P3 ã¾ã§ 制御ãƒãƒ£ãƒ³ãƒãƒ«ã‹ã‚‰å—ä¿¡ã—ãŸãƒ‡ãƒ¼ã‚¿ã®å‡¦ç†ã«ãŠã‘ã‚‹ assertion failure - CVE-2016-1285 named ã«ã¯ã€åˆ¶å¾¡ãƒãƒ£ãƒ³ãƒãƒ«ã‹ã‚‰æ‚ªæ„ã‚るパケットをå—ä¿¡ã™ã‚‹ã“ã¨ã§ã€sexpr.c ã¾ãŸã¯ alist.c 㧠assertion failure ãŒç™ºç”Ÿã—ã€ãƒ—ãƒã‚»ã‚¹ãŒç•°å¸¸çµ‚了ã™ã‚‹è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚ ã“ã® assertion ãƒã‚§ãƒƒã‚¯ã¯ã€ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ã‚¢ãƒ‰ãƒ¬ã‚¹ã«ã‚ˆã‚‹ã‚¢ã‚¯ã‚»ã‚¹åˆ¶é™ã‚’通éŽã—ãŸå¾Œã€(共通éµã«ã‚ˆã‚‹) èªè¨¼å‡¦ç†ã®å‰ã«è¡Œã‚ã‚Œã¾ã™ã€‚ã—ãŸãŒã£ã¦ã€named.conf ã® controls ステートメントã®è¨å®šã§è¨±å¯ã•ã‚Œã¦ã„るアドレス範囲ã‹ã‚‰ãƒ‘ケットをé€ä¿¡ã§ãる攻撃者
Samba for Enterprise Linux and AIX
SAMBA+ is the leading open IAM solution for Identity and Access Management and the best open source SMB software for a variety of Linux distributions and IBM AIX provided by SerNet for customers all over the world and offered at shop.samba.plus and at usdshop.samba.plus for U.S. based customers. SerNet's SAMBA+ is built from one source package for all platforms, always up-to-date, including most r
Perception Point Blog Archive: Attack Trends | Page 1 of 10
Solutions Back To Menu Solutions By Channel Read the company overview to learn more about how Perception Point provides unparalleled prevention of advanced cyber threats across all attack vectors.
RFD 2015
ã“ã®è¨˜äº‹ã¯ã€Œè„†å¼±æ€§"&'<<>\ Advent Calendar 2015ã€21日目ã®è¨˜äº‹ã§ã™ã€‚ CSP 2015ãŒã‹ã£ã“よéŽãŽãŸã®ã§ãƒ‘クりã¾ã—ãŸï½— Reflected File Download（以後RFD）ã¯Black Hat Europe 2014ã§ç™ºè¡¨ã•ã‚ŒãŸæ¯”較的新ã—ã„脆弱性ã§ã™ã€‚今年ã«ãªã‚ŠRFD Cheat Sheetãªã‚‹è¨˜äº‹ã‚‚書ã‹ã‚Œã¾ã—ãŸã€‚実ã¯åƒ•ã‚‚今年ã®å¾ŒåŠã¯RFDã°ã‹ã‚Šè¦‹ã¦ã„ã¾ã—ãŸã€‚ æ¦‚è¦ RFDã¯ãã®åã®é€šã‚Š3ã¤ã®è¦ç´ ãŒã‹ã‚‰ãªã‚Šã¾ã™ã€‚ 1. Reflected ユーザーã®å…¥åŠ›ã—ãŸå€¤ãŒãƒ¬ã‚¹ãƒãƒ³ã‚¹ã«åæ˜ ã•ã‚Œã‚‹ã€‚ 2. File URLã«ä»»æ„ã®æ–‡å—åˆ—ã‚’è¿½åŠ ã§ãã€å°šä¸”ã¤æ£å¸¸ã«ãƒãƒ¼ãƒ‰ã•ã‚Œã‚‹ã€‚ 3. Download ダウンãƒãƒ¼ãƒ‰ãŒå¯èƒ½ã§ã‚ã‚Šã€ä¸Šè¨˜2ã¤ã®è¦ç´ ãŒãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã—ãŸãƒ•ã‚¡ã‚¤ãƒ«ã«åæ˜ ã•ã‚Œã‚‹ã€‚ 例 ユーザーãŒæ¤œç´¢ãƒãƒ¼ã«æ–‡å—を入れãŸéš›ã«ã€JSONを使ã„å‹•çš„ã«å€™è£œã‚’表示ã™ã‚‹ã‚µã‚¤ãƒˆãŒã‚ã‚‹
Back to 28: Grub2 Authentication Bypass 0-Day
December 10th, 2015 - Disclosed at IX Jornadas STIC CCN-CERT. December 14th, 2015 - Published in the web. Description A vulnerability in Grub2 has been found. Versions from 1.98 (December, 2009) to 2.02 (December, 2015) are affected. The vulnerability can be exploited under certain circumstances, allowing local attackers to bypass any kind of authentication (plain or hashed passwords). And so, the
iOS版「niconicoã€ã‚¢ãƒ—リã«ãŠã‘る脆弱性ã¨ã€ã‚»ã‚ュリティ強化ã«ã¤ã„ã¦â€ãƒ‹ã‚³ãƒ‹ã‚³ã‚¤ãƒ³ãƒ•ã‚©
niconicoã‚’ã”利用ã„ãŸã ãã€ã‚ã‚ŠãŒã¨ã†ã”ã–ã„ã¾ã™ã€‚ iOS版「niconicoã€ã‚¢ãƒ—リã«ãŠãã¾ã—ã¦ã€ã€Œæ‚ªæ„ã®ã‚る第三者ãŒã€ç‰¹å®šã®ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ä¸Šã«ãŠã„ã¦ã€é€šä¿¡å†…容ã®ä¸€éƒ¨ã‚’èªã¿å–ã‚‹ã“ã¨ãŒã§ãã‚‹å±é™ºæ€§ã€ãŒç™ºè¦‹ã•ã‚Œã¾ã—ãŸã€‚ 概è¦ã¨å¯¾ç–ã‚’ãŠçŸ¥ã‚‰ã›ã„ãŸã—ã¾ã™ã€‚
JVNVU#91383623: ISC BIND 9 ã«è¤‡æ•°ã®è„†å¼±æ€§
影響をå—ã‘るシステムã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã¯è„†å¼±æ€§ã”ã¨ã«ç•°ãªã‚Šã¾ã™ãŒã€ã„ãšã‚Œã‚‚ DNS リカーシブサーãƒã«å½±éŸ¿ã‚’与ãˆã‚‹è„†å¼±æ€§ã§ã‚ã‚‹ãŸã‚ã€å½±éŸ¿ã¯åºƒç¯„囲ã«åŠã¶å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ CVE-2015-5722 ã®è„†å¼±æ€§ã®å½±éŸ¿ã‚’å—ã‘るシステムBIND 9.0.0 ã‹ã‚‰ 9.8.8 ã¾ã§ BIND 9.9.0 ã‹ã‚‰ 9.9.7-P2 ã¾ã§ BIND 9.10.0 ã‹ã‚‰ 9.10.2-P3 ã¾ã§ CVE-2015-5986 ã®è„†å¼±æ€§ã®å½±éŸ¿ã‚’å—ã‘るシステムBIND 9.9.7 ã‹ã‚‰ 9.9.7-P2 ã¾ã§ BIND 9.10.2 ã‹ã‚‰ 9.10.2-P3 ã¾ã§ ç´°å·¥ã•ã‚ŒãŸ DNSSEC éµã®å‡¦ç†ã«èµ·å› ã™ã‚‹ã‚µãƒ¼ãƒ“スé‹ç”¨å¦¨å®³ (DoS) ã®è„†å¼±æ€§ - CVE-2015-5722 ISC ã®ã‚¢ãƒ‰ãƒã‚¤ã‚¶ãƒªã«ã¯æ¬¡ã®ã‚ˆã†ã«è¨˜è¼‰ã•ã‚Œã¦ã„ã¾ã™ã€‚ Parsing a malformed DNSSEC key can cause
Multiple Vulnerabilities in Pocket · gnu.gl
Tue, Aug 18, 2015 Pocket Background I haven’t used Firefox as my primary browser in many years, so I have to admit that I hadn’t heard of Pocket until I saw this Bugzilla bug in a Hacker News post. In short, the Mozilla Foundation bundled what is essentially an opt-out, non-removable Pocket extension into all versions of Firefox. In spite of a mild end-user revolt on Bugzilla and the Mozilla gover
エフセã‚ュアブãƒã‚° : ãŠä½¿ã„ã®Android端末ã®ã€ŒStagefrightã€ãƒã‚°å•é¡Œã«å¯¾å‡¦ã™ã‚‹2ã¤ã®æ–¹æ³•
ãŠä½¿ã„ã®Android端末ã®ã€ŒStagefrightã€ãƒã‚°å•é¡Œã«å¯¾å‡¦ã™ã‚‹2ã¤ã®æ–¹æ³• 2015å¹´08月11æ—¥08:00 ツイート fsecure_blog ヘルシンã‚発 今回ã€ã€ŒStagefrightã€ã®ãƒã‚°å•é¡Œã§çŸ¥ã‚‰ã‚Œã‚‹ Android ã®è„†å¼±æ€§ã«ã‚ˆã£ã¦ã€Android オペレーティングシステムã®æŠ±ãˆã‚‹å•é¡Œç‚¹ãŒæµ®ã彫りã«ãªã£ã¦ã„ã¾ã™ã€‚ ç†è«–çš„ã«ã¯ã€ãŸã£ãŸ1通ã®ãƒžãƒ«ãƒãƒ¡ãƒ‡ã‚£ã‚¢ãƒ¡ãƒƒã‚»ãƒ¼ã‚¸ï¼ˆMMS）ã«ã‚ˆã£ã¦ã€æºå¸¯é›»è©±ãŒä¹—ã£å–られるæã‚ŒãŒã‚ã‚‹ã®ã§ã™ã€‚ エフセã‚ュアラボã§ã¯ã€ã“ã®è„†å¼±æ€§ã‚’ç‹™ã£ãŸè„…å¨ã®ç›£è¦–ã‚’é‹æ„継続ä¸ã§ã™ã€‚ ç†è«–上ã¯æ”»æ’ƒãƒªã‚¹ã‚¯ãŒé«˜ãã€ã¾ãŸAndroidを標的ã¨ã—ãŸã•ã¾ã–ã¾ãªãƒ¢ãƒã‚¤ãƒ«ãƒžãƒ«ã‚¦ã‚§ã‚¢ãŒå®šæœŸçš„ã«ç¢ºèªã•ã‚Œã¦ã„ã‚‹ã‚‚ã®ã®ã€ä»Šå›žã®Android ã®è„†å¼±æ€§ã‚’ç‹™ã£ãŸæ”»æ’ƒãŒã¾ã 観測ã•ã‚Œã¦ã„ãªã„ã¨ã„ã†ã“ã¨ã¯ã€å–œã°ã—ã„状æ³ã¨è¨€ãˆã‚‹ã§ã—ょã†ã€‚ ã—ã‹ã—今回ã®å•é¡Œã¯é‡å¤§ã§ã‚ã‚Šã€Android ã®ã‚»ã‚ュリ
エフセã‚ュアブãƒã‚° : 悪æ„ã®ã‚る数独å•é¡Œãƒ•ã‚¡ã‚¤ãƒ«ã‚’èªã¿è¾¼ã‚€ã“ã¨ã§ä»»æ„ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’実行ã•ã‚Œã‚‹è„†å¼±æ€§
悪æ„ã®ã‚る数独å•é¡Œãƒ•ã‚¡ã‚¤ãƒ«ã‚’èªã¿è¾¼ã‚€ã“ã¨ã§ä»»æ„ã®ã‚³ãƒžãƒ³ãƒ‰ã‚’実行ã•ã‚Œã‚‹è„†å¼±æ€§ 2015å¹´08月10æ—¥08:00 ツイート daiki_fukumori オフィシャルコメント by：ç¦æ£® 大喜 æ¦‚è¦ ã‚·ãƒ³ã‚¬ãƒãƒ¼ãƒ«ã®é¦–相リーシェンãƒãƒ³æ°ã«ã‚ˆã£ã¦é–‹ç™ºã•ã‚ŒãŸSudoku solverã«ã¯ã€ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã®è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚ 影響をå—ã‘るシステムSudoku solverを組ã¿è¾¼ã‚“ã ã‚·ã‚¹ãƒ†ãƒ è©³ç´°æƒ…å ± Sudoku solverã«ã¯å…¥åŠ›ãƒ‡ãƒ¼ã‚¿ã®å‡¦ç†ã«èµ·å› ã™ã‚‹ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ (CWE-121) ã®è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚ 想定ã•ã‚Œã‚‹å½±éŸ¿ ç´°å·¥ã•ã‚ŒãŸæ•°ç‹¬å•é¡Œãƒ•ã‚¡ã‚¤ãƒ«ã‚’èªã¿è¾¼ã‚€ã“ã¨ã§ã€ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ã‚’実行ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ 対ç–方法 ä¸å¯©ãªæ•°ç‹¬å•é¡Œãƒ•ã‚¡ã‚¤ãƒ«ã‚’é–‹ã‹ãªã„よã†ã«ã—ã¦ãã ã•ã„。 å‚è€ƒæƒ…å ±ã‚·ãƒ³ã‚¬ãƒãƒ¼ãƒ«é¦–相ã€è‡ªä½œã®ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°ã‚³ãƒ¼ãƒ‰ã‚’Facebookã§å…¬é–‹ã‚·ãƒ³ã‚¬ãƒãƒ¼ãƒ«é¦–相ã®ã€IT
OpenSSLã®è„†å¼±æ€§(CVE-2015-1793)ã«ã‚ˆã‚‹Altãƒã‚§ãƒ¼ãƒ³è¨¼æ˜Žæ›¸å½é€ ã®ä»•çµ„ã¿ - ã¼ã¡ã¼ã¡æ—¥è¨˜
TL;DR ã‚„ã£ã±ã‚Šæ›¸ã„ã¦ã„ãŸã‚‰é•·æ–‡ã«ãªã£ã¦ã—ã¾ã„ã¾ã—ãŸã€‚ã‚ã¾ã‚Šã¡ã‚ƒã‚“ã¨æŽ¨æ•²ã™ã‚‹æ°—力ãŒãªã„ã®ã§ã€å¤‰ãªæ–‡ç« ã«ãªã£ã¦ã„ã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“。ã”了承ã„ãŸã ã‘ã‚‹æ–¹ã®ã¿ãŠèªã¿ãã ã•ã„。 1. ã¯ã˜ã‚㫠昨晩未明ã«OpenSSL-1.0.2d, 1.0.1pãŒãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¾ã—ãŸã€‚事å‰ã«äºˆå‘Šã•ã‚Œã¦ã„ãŸé€šã‚Šæ·±åˆ»åº¦é«˜ã®è„†å¼±æ€§CVE-2015-1793ãŒä¿®æ£ã•ã‚Œã¦ã„ã¾ã™ã€‚Advisoryを見るã¨ã€ã“ã®è„†å¼±æ€§ãŒiojs/Nodeã«å½±éŸ¿ãŒã‚ã‚‹ã¨ã„ã†ã“ã¨ãŒåˆ¤æ˜Žã—ãŸã®ã§ç›´ã¡ã«iojs/Nodeã®ã‚¢ãƒƒãƒ—デートを行ã„ã€ä»Šæœæœªæ˜Žã«ç„¡äº‹è„†å¼±æ€§å¯¾å¿œç‰ˆã‚’リリースã—ã¾ã—ãŸã€‚ 今回ãŒåˆã‚ã¦ã§ã¯ã‚ã‚Šã¾ã›ã‚“ãŒã€æ·±å¤œã«æ—¥æ¬§ç±³ã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ãŒgithub上ã§äº’ã„ã«é€£æºã—ãªãŒã‚‰é€Ÿã‚„ã‹ã«ã‚»ã‚ュリティ対ç–ã®ãƒªãƒªãƒ¼ã‚¹ä½œæ¥ã‚’è¡Œã†ã“ã¨ã¯ä½•å›žã‚„ã£ã¦ã‚‚ãªã‹ãªã‹ã—ã³ã‚Œã‚‹çµŒé¨“ã§ã™ã€‚時差もã‚ã‚Šãªã‹ãªã‹ä½“力的ã«ã¯è¾›ã„ã‚‚ã®ãŒã‚ã‚Šã¾ã™ãŒã€ä¸–ç•Œã®è¶…一æµã®ã‚¨ãƒ³ã‚¸ãƒ‹ã‚¢ã¨å…±åŒã§ãƒªã‚¢
FREAK ã«ã¤ã„ã¦ã¾ã¨ã‚ã¦ã¿ãŸ - piyolog
輸出グレードã®RSAæš—å·ã‚’サãƒãƒ¼ãƒˆã—ã¦ã„ãŸã“ã¨ã«èµ·å› ã™ã‚‹è„†å¼±æ€§FREAKã«é–¢ã™ã‚‹æƒ…å ±ã«ã¤ã„ã¦é–¢é€£æƒ…å ±ã‚’ã¾ã¨ã‚ã¾ã™ã€‚ è„†å¼±æ€§æ¦‚è¦ è„†å¼±æ€§ã®æ¦‚è¦æƒ…å ±ã¯æ¬¡ã®é€šã‚Šã€‚ 愛称 FREAK (Factoring attack on RSA-EXPORT Keysã®ç•¥) 輸出グレード暗å·ã®å¼·åˆ¶ä½¿ç”¨ã«é–¢ã™ã‚‹å‘¼ç§° アイコン ç„¡ã— CVE OpenSSL：CVE-2015-0204 Apple：CVE-2015-1067 Microsoft：CVE-2015-1637 発見者å miTLS Inria(ãƒ•ãƒ©ãƒ³ã‚¹å›½ç«‹æƒ…å ±å¦è‡ªå‹•åˆ¶å¾¡ç ”究所)ã¨Microsoft Researchã®åˆåŒãƒãƒ¼ãƒ FREAK Attackã®æ¦‚è¦ ä¸é–“者攻撃ãŒè¡Œã‚れるã¾ã§ã®FREAK Attackã®æµã‚Œã¯æ¬¡ã®é€šã‚Šã€‚(3月6日更新) MITMã®æ”»æ’ƒæˆç«‹æ¡ä»¶ 以下ã®æ¡ä»¶ãŒæˆç«‹ã™ã‚‹å ´åˆã€é€šä¿¡å†…容ã®ç›—è´ã‚„改ã–ã‚“ã®å½±éŸ¿ã‚’å—ã‘ã‚‹å¯èƒ½æ€§ãŒã‚る。 接続元・
Analysis on Internet Explorer's UXSS
Status: Fixed (as of Jan 13, 2016) Recently a Universal Cross-Site Scripting(UXSS) vulnerability (CVE-2015-0072) was disclosed on the Full Disclosure mailing list. This unpatched 0day vulnerability discovered by David Leo results in a full bypass of the Same-Origin Policy(SOP) on the latest version of Internet Explorer. This article will briefly explain the technical details behind the vulnerabili
脆弱性"&'\ Advent Calendar 2014 (12日目) - 葉ã£ã±æ—¥è¨˜
ã“ã®è¨˜äº‹ã¯è„†å¼±æ€§"&'<<>\ Advent Calendar 2014ã®12日目ã®è¨˜äº‹ã§ã™ã€‚ Enjoy!
（緊急）複数ã®DNSソフトウェアã«ãŠã‘る脆弱性（システム資æºã®éŽåº¦ãªæ¶ˆè²»ï¼‰ã«ã¤ã„ã¦ï¼ˆ2014å¹´12月25日更新）
--------------------------------------------------------------------- ■（緊急）複数ã®DNSソフトウェアã«ãŠã‘る脆弱性（システム資æºã®éŽåº¦ãªæ¶ˆè²»ï¼‰ ã«ã¤ã„ã¦ï¼ˆ2014å¹´12月9日公開） - BIND 9ã§ã¯æ¨©å¨DNSサーãƒãƒ¼ã«ã‚‚é™å®šçš„ã«å½±éŸ¿ã€ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã‚¢ãƒƒãƒ—ã‚’å¼·ã推奨 - æ ªå¼ä¼šç¤¾æ—¥æœ¬ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã‚µãƒ¼ãƒ“ス（JPRS） åˆç‰ˆä½œæˆ 2014/12/09（Tue） 最終更新 2014/12/25（Thu） （米国The CERT Divisionã®æ³¨æ„喚起・Vendor Informationã¸ã®ãƒªãƒ³ã‚¯ã‚’è¿½åŠ ï¼‰ --------------------------------------------------------------------- â–¼æ¦‚è¦ BIND 9・Unbound・PowerDNS Recursorã‚’å«ã‚€è¤‡
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
HTC caught storing fingerprints AS WORLD-READABLE CLEARTEXT
Engadget | Technology News & Reviews
https://srlabs.de/blog/wp-content/uploads/2014/07/SRLabs-BadUSB-BlackHat-v1.pdf
https://lock.cmpxchg8b.com/sophailv2.pdf
{{#tags}}- {{label}}
{{/tags}}