CVE-2018-7160 - Pwning (NodeJS) Developers
TL;DR:Â Â NodeJS in debug mode did not check the Origin-Header of websocket connections. This could lead to arbitrary code execution on victims systems if they visited a malicious website while debugging NodeJS. Visual Studio Code 1.19 - 1.19.2 was running in debug mode by default and exposed all users to this vulnerability. Due to my suspiciousness against 3rd party software (probably a side effect
æºå¸¯é›»è©±é–¢é€£ã®ã‚»ã‚ュリティ DNS Rebinding ã¾ã¨ã‚ [IIS/5.0ã®HRSã«ã‚ˆã‚Šæºå¸¯ã‹ã‚‰ä»»æ„ã®HTTPリクエストをé€ä¿¡å¯èƒ½] - KENJI’S BLOG
マイナーã‹ã‚‚ã—ã‚Œãªã„ã‘ã©ã€HTTP Request Smuggling（通称HRS）ã¨ã„ã†æ”»æ’ƒæ‰‹æ³•ãŒã‚ã‚Šã¾ã™ã€‚詳ã—ãã¯WizardBible vol.19ã®é‡‘床æ°ã®HRS記事をå‚照。ãã—ã¦ã€ãã‚Œã«é–¢é€£ã—ã¦ã€IIS/5.0ã®48kbãƒã‚°ï¼ˆä»•æ§˜?）ã¨ã„ã†ã‚‚ã®ãŒã‚ã‚Šã¾ã—ã¦ã€ç°¡å˜ã«è¨€ã†ã¨ã€IIS/5.0ã¯ã€Content-TypeヘッダãŒç„¡ã„48kb以上ã®ãƒœãƒ‡ã‚£éƒ¨ã‚’æŒã¤HTTPリクエストã«å¯¾ã—ã¦ã€ç„¡æ¡ä»¶ã«ãƒœãƒ‡ã‚£éƒ¨ã‚’48kbã«æ±ºã‚ã¤ã‘ã‚‹ã¨ã„ã†ã‚‚ã®ã§ã™ï¼ˆä»¥ä¸‹ã€WizardBible vol.19ã®HRS記事ã‹ã‚‰å¼•ç”¨ï¼‰ã€‚ IIS/5.0ã«ã¯ã¨ã¦ã‚‚ã‚ã‘ã®ã‚ã‹ã‚‰ãªã„ãƒã‚°ãŒã‚るよã†ã§ã€48kb以上ã®ãƒœãƒ‡ã‚£éƒ¨ã‚’æŒã¡ã€ã‹ã¤Content-TypeヘッダーフィールドãŒç„¡ã„HTTPリクエストã¯ã€ç„¡æ¡ä»¶ã«ãƒœãƒ‡ã‚£éƒ¨ã‚’48kbã¡ã‚‡ã†ã©ã¨æ±ºã‚ã¤ã‘ã¦ã—ã¾ã†ã‚ˆã†ã§ã™ã€‚ ã¡ãªã¿ã«IIS/5.1ã‚‚5.0åŒæ§˜48kb決ã‚ã†ã¡ã‚’è¡Œã„ã¾ã™
ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ± - iモードIDを用ã„ãŸã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ã®DNS Rebinding脆弱性
iモードIDを用ã„ãŸã€Œã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã€ã®DNS Rebinding脆弱性 HASHã‚³ãƒ³ã‚µãƒ«ãƒ†ã‚£ãƒ³ã‚°æ ªå¼ä¼šç¤¾ 公開日:2009å¹´11月24æ—¥ æ¦‚è¦ iモードブラウザ2.0ã®JavaScriptã¨DNS Rebindingå•é¡Œã®çµ„ã¿åˆã‚ã›ã«ã‚ˆã‚Šã€iモードIDを利用ã—ãŸèªè¨¼æ©Ÿèƒ½ï¼ˆä»¥ä¸‹ã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ï¼‰ã«å¯¾ã™ã‚‹ä¸æ£ã‚¢ã‚¯ã‚»ã‚¹ãŒå¯èƒ½ã¨ãªã‚‹å ´åˆãŒã‚ã‚‹ã“ã¨ã‚’確èªã—ãŸã®ã§å ±å‘Šã™ã‚‹ã€‚å±é™ºåº¦ã®é«˜ã„攻撃手法ã§ã‚ã‚‹ã®ã§ã€ã‚µã‚¤ãƒˆé‹å–¶è€…ã«ã¯è‡³æ€¥ã®å¯¾ç–を推奨ã™ã‚‹ã€‚ 背景æºå¸¯é›»è©±ã®ã‹ã‚“ãŸã‚“ãƒã‚°ã‚¤ãƒ³ã¨ã¯ã€ã‚±ãƒ¼ã‚¿ã‚¤ãƒ–ラウザ（ãŸã¨ãˆã°iモードブラウザ）ã«ç”¨æ„ã•ã‚ŒãŸå¥‘約者固有IDを利用ã—ãŸç°¡æ˜“çš„ãªèªè¨¼ã§ã‚ã‚Šã€ãƒ¦ãƒ¼ã‚¶ãŒIDやパスワードを入力ã—ãªãã¦ã‚‚èªè¨¼ãŒå¯èƒ½ã¨ãªã‚‹ã€‚iモードIDã¯ã€NTTドコモã®æä¾›ã™ã‚‹å¥‘約者固有IDã®ä¸€ç¨®ã§ã€URLã«guid=ONã¨ã„ã†ã‚¯ã‚¨ãƒªã‚¹ãƒˆãƒªãƒ³ã‚°ã‚’å«ã‚ã‚‹ã“ã¨ã«ã‚ˆã‚Šã€ç«¯æœ«å›ºæœ‰ã®7æ¡ã®IDãŒWebサーãƒã«é€
Farfromr00tin: Flash DNS Rebinding Attack Explained
Instead of waiting a couple days to post about this, I guess I'll do it now. It's a pretty interesting flaw and since no one has posted the technical details of it yet, I'll be the one to do it. First of all, this attack relies on DNS canonicalization differences between the browser and Flash. I'm going to pick on IE for this example. So let's say your DNS search domain is mycompany.com and let's
Adobe Flash & Facebook Platform samples | Adobe Developer Connection
Flash Player’s EOL is coming at the end of 2020. See the roadmap for Flash Player and AIR’s EOL: Adobe Flash Player EOL General Information Page The Future of Adobe AIR You can access the archived documents relevant to Flash Runtime even after the Flash EOL date. We are providing access to the archived documents for all the user/developers community to download. These documents are now no longer u
JVNDB-2008-001286 Adobe Flash Player ã«ãŠã‘ã‚‹ DNS Rebinding 攻撃をå—ã‘る脆弱性
CVSS v2 ã«ã‚ˆã‚‹æ·±åˆ»åº¦ 基本値: 4.3 (è¦å‘Š) [NVD値] 攻撃元区分: ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯ 攻撃æ¡ä»¶ã®è¤‡é›‘ã•: ä¸ æ”»æ’ƒå‰ã®èªè¨¼è¦å¦: ä¸è¦ 機密性ã¸ã®å½±éŸ¿(C): ãªã— 完全性ã¸ã®å½±éŸ¿(I): 部分的 å¯ç”¨æ€§ã¸ã®å½±éŸ¿(A): ãªã— アップル Apple Mac OS X 10.5.3 未満 Apple Mac OS X Server 10.5.3 未満 アドビシステムズ Adobe Flash Player 9.0.115.0 ãŠã‚ˆã³ãã‚Œä»¥å‰ Adobe Flash Player 8.0.39.0 ãŠã‚ˆã³ãã‚Œä»¥å‰ ã‚µãƒ³ãƒ»ãƒžã‚¤ã‚¯ãƒã‚·ã‚¹ãƒ†ãƒ ズ Sun Solaris 10 (sparc) Sun Solaris 10 (x86) ターボリナックス Turbolinux FUJI wizpy レッドãƒãƒƒãƒˆ Red Hat Enterprise Linux Extras 3 extras
1
リリースã€éšœå®³æƒ…å ±ãªã©ã®ã‚µãƒ¼ãƒ“スã®ãŠçŸ¥ã‚‰ã›
最新ã®äººæ°—エントリーã®é…ä¿¡
j次ã®ãƒ–ックマーク
kå‰ã®ãƒ–ックマーク
lã‚ã¨ã§èªã‚€
eコメント一覧を開ã
oページを開ã
Shigeki Ohtsu on Twitter: "WebRTCã§ãƒãƒ¼ã‚«ãƒ«IPã‚’å–å¾—ã—ã¦ãƒ«ãƒ¼ã‚¿ã‚¢ãƒ‰ãƒ¬ã‚¹ã‚’探ã—出ã—DNS rebidingã§ãƒ«ãƒ¼ã‚¿ã¸æŽ¥ç¶šã—exploitã‚’é€ã‚Šè¾¼ã¿æœ€çµ‚çš„ã«telnetã‚’æˆåŠŸã•ã›ã‚‹æ”»æ’ƒã‚’実証ã—ãŸã®ã‹ã€‚ / “Practical Attacks wi…†https://t.co/FWsMn39MeA"
http://securitytracker.com/alerts/2008/Apr/1019808.html
{{#tags}}- {{label}}
{{/tags}}