[B! security][vulnerability] ori53ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

ori53 id:ori53

securityã¨vulnerabilityã«é–¢ã™ã‚‹ori53ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (5)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

æ°´é£²ã¿å ´åž‹æ”»æ’ƒã«é–¢ã™ã‚‹å¯¾ç–ã«ã¤ã„ã¦ | ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ãƒ©ãƒƒã‚¯
Webã‚µã‚¤ãƒˆç®¡ç†è€…ã¨ãã®è¨ªå•è€…æ¯Žã«ã€è¢«å®³ã®ç™ºè¦‹ã€æ’ä¹…çš„ãªå¯¾ç–ã®è¦–ç‚¹ã§ã€æƒ…å ±ã‚’æ•´ç†ã—ã¾ã™ã€‚ 1. Webã‚µã‚¤ãƒˆç®¡ç†è€…ã®å¯¾å¿œ ä»Šå›žã®æ°´é£²ã¿å ´åž‹ã®æ”»æ’ƒã®å ´åˆã€é–²è¦§è€…ãŒé›†ã¾ã‚‹Webã‚µã‚¤ãƒˆãŒç‹™ã‚ã‚Œã€ã‚³ãƒ³ãƒ†ãƒ³ãƒ„ã®æ”¹ã–ã‚“ãŒè¡Œã‚ã‚Œã‚‹ã“ã¨ãŒè€ƒãˆã‚‰ã‚Œã¾ã™ã€‚æ”»æ’ƒè€…ã®è¡Œç‚ºã«åŠ æ‹…ã—ãªã„ã‚ˆã†ã€Webã‚µã‚¤ãƒˆã®ç¾çŠ¶ã®ç¢ºèªã¨ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã‚’ãŠé¡˜ã„ã„ãŸã—ã¾ã™ã€‚ 1.1 Webã‚µã‚¤ãƒˆã®æ€§æ ¼ã‚’ã‚ãã¾ãˆã‚‹ã€‚ è‡ªç¤¾ã®ã‚µã‚¤ãƒˆãŒã©ã®ã‚ˆã†ãªæ€§æ ¼ã‚’æŒã¤ã‚µãƒ¼ãƒ“ã‚¹ã‚’æä¾›ã—ã¦ã„ã‚‹ã®ã‹ã‚’æŠŠæ¡ã™ã‚‹ã“ã¨ã¯å¤§å¤‰é‡è¦ã§ã™ã€‚ä¾‹ãˆã°ã€ä»¥ä¸‹ã®ã‚ˆã†ãªç‰¹è‰²ã‚’æŠŠæ¡ã™ã‚‹ã“ã¨ã¯ã€æ°´é£²ã¿å ´ã«é›†ã¾ã‚‹ã‚µã‚¤ãƒãƒ¼æ”»æ’ƒå¯¾è±¡è€…ã‚’çµžã‚Šè¾¼ã‚€ãƒ’ãƒ³ãƒˆã‚’å¾—ã‚‹ã“ã¨ãŒã§ãã¾ã™ã€‚ ä¸ç‰¹å®šå¤šæ•°ã¸æä¾›ã—ã¦ã„ã‚‹ã‚µãƒ¼ãƒ“ã‚¹ è¡Œæ”¿æ©Ÿé–¢ã‚„é‡è¦ã‚¤ãƒ³ãƒ•ãƒ©ä¼æ¥ãªã©ã®ç¤¾ä¼šã‚µãƒ¼ãƒ“ã‚¹ å¤–äº¤ã€é˜²è¡›æŠ€è¡“ã€ã‚¨ãƒãƒ«ã‚®ãƒ¼é–‹ç™ºãªã©ã€å¯¾è±¡è€…ã«ç‹™ã„ã‚’ã¤ã‘ãŸã‚µãƒ¼ãƒ“ã‚¹ 1.2 Webã‚µã‚¤ãƒˆã®é‹ç”¨ãƒ¬ãƒ™ãƒ«ã‚’æŠŠæ¡ã™ã‚‹ ã‚ªãƒšãƒ¬ãƒ¼ãƒ†ã‚£ãƒ³ã‚°ã‚·ã‚¹ãƒ†ãƒ (OS
ori53 2013/10/11
security

vulnerability
ãƒªãƒ³ã‚¯
æ—¥æœ¬ã«ãŠã‘ã‚‹æ°´é£²ã¿å ´åž‹æ”»æ’ƒã«é–¢ã™ã‚‹æ³¨æ„å–šèµ· | ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã®ãƒ©ãƒƒã‚¯
å½“ç¤¾ã¯ã€ãƒžã‚¤ã‚¯ãƒã‚½ãƒ•ãƒˆç¤¾ã® Internet Explorerã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã—ãŸæ¨™çš„åž‹æ”»æ’ƒã«ã‚ˆã‚Šã€ã‚¦ã‚¤ãƒ«ã‚¹æ„ŸæŸ“è¢«å®³ã‚’ç¢ºèªã—ãŸãŸã‚ã€ã“ã®è„†å¼±æ€§ã‚’è»½æ¸›ã™ã‚‹å›žé¿ç–ã‚’å®Ÿæ–½ã—ã¦ã„ãŸã ãã‚ˆã†ã€2013å¹´9æœˆ19æ—¥ã«æ³¨æ„å–šèµ·ã‚’æŽ²è¼‰ã—ã¾ã—ãŸã€‚ Internet Explorerã®ã€Œã‚¼ãƒãƒ‡ã‚¤ã®è„†å¼±æ€§ã€ã‚’æ‚ªç”¨ã—ãŸæ”»æ’ƒã«å¯¾ã™ã‚‹æ³¨æ„å–šèµ· ã“ã®äº‹æ¡ˆã§è¡Œã‚ã‚ŒãŸæ”»æ’ƒã®æ‰‹æ³•ã¯ã€ä¸€èˆ¬ã«ã€Œæ°´é£²ã¿å ´åž‹æ”»æ’ƒã€ã¨ã—ã¦çŸ¥ã‚‰ã‚Œã‚‹ã‚‚ã®ã§ã€æ”»æ’ƒè€…ã¯ä¸ç‰¹å®šãƒ¦ãƒ¼ã‚¶ãƒ¼ã¾ãŸã¯ç‰¹å®šã®ãƒ¦ãƒ¼ã‚¶ãƒ¼å±¤ï¼ˆçµ„ç¹”ã€æ¥ç•Œã€åœ°åŸŸç‰ï¼‰ãŒé–²è¦§ã™ã‚‹Webã‚µã‚¤ãƒˆã‚’æ”¹ã–ã‚“ã—ã¦ä¸æ£ãªãƒ—ãƒã‚°ãƒ©ãƒ ã‚’è¨ç½®ã—ã€ã—ã‹ã‚‚é–²è¦§ã•ã‚ŒãŸæ–¹ã‚’é¸åˆ¥ã—ã€ä¸æ£ãƒ—ãƒã‚°ãƒ©ãƒ ï¼ˆã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ã‚¦ã‚¤ãƒ«ã‚¹ï¼‰ã‚’é…å¸ƒã™ã‚‹ãªã©ã®è¢«å®³ã‚’ä¸Žãˆã‚‹ã‚‚ã®ã§ã—ãŸã€‚ æœ¬æ³¨æ„å–šèµ·ã§ã¯ã€æœ¬äº‹æ¡ˆã«é–¢é€£ã—ã€æ—¥æœ¬ã«ãŠã„ã¦ç¢ºèªã•ã‚ŒãŸæ°´é£²ã¿å ´åž‹æ”»æ’ƒã®ç‰¹å¾´ã¨ã€ãã®å¯¾å‡¦æ–¹æ³•ã‚’æ•´ç†ã™ã‚‹ã“ã¨ã§ã€æœ¬æ”»æ’ƒã«å¯¾ã™ã‚‹èªçŸ¥ã‚’é«˜ã‚ã€äºˆé˜²ã¨äº‹æ•…å¯¾å¿œã«å‘ã‘ãŸæ³¨æ„å–šèµ·ã‚’ã„ãŸã—
ori53 2013/10/11
security

vulnerability
ãƒªãƒ³ã‚¯
ã‚¨ãƒ•ã‚»ã‚ãƒ¥ã‚¢ãƒ–ãƒã‚° : ã„ã‹ã«Windows XPãŒæ”»æ’ƒã—ã‚„ã™ã„ã‹
ã„ã‹ã«Windows XPãŒæ”»æ’ƒã—ã‚„ã™ã„ã‹ 2013å¹´10æœˆ08æ—¥07:39 ãƒ„ã‚¤ãƒ¼ãƒˆ daiki_fukumori ã‚ªãƒ•ã‚£ã‚·ãƒ£ãƒ«ã‚³ãƒ¡ãƒ³ãƒˆÂ byï¼šç¦æ£® å¤§å–œ å…ˆæ—¥ã‚ˆã‚ŠInternet Explorerã®ã‚¼ãƒãƒ‡ã‚¤æ”»æ’ƒ(CVE-2013-3893)ãŒã‚¢ã‚¸ã‚¢å„åœ°ã§ç¢ºèªã•ã‚Œã¦ãŠã‚Šã€Metasploitã«ã‚‚æ”»æ’ƒãƒ¢ã‚¸ãƒ¥ãƒ¼ãƒ«ãŒçµ„ã¿è¾¼ã¾ã‚ŒãŸã“ã¨ã§å±é™ºæ€§ãŒé«˜ã¾ã£ã¦ã„ã¾ã™ã€‚ç¾åœ¨ã®ã¨ã“ã‚Metasploitã§å¯¾è±¡ã¨ãªã£ã¦ã„ã‚‹ã®ã¯ã€Office 2007/2010ãŒã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ã‚‹Windows 7ã®IE8/IE9ã ã‘ã§ã™ãŒã€Windows XPã‚’æ”»æ’ƒã™ã‚‹ã®ã¯ç°¡å˜ã§Officeãªã‚“ã‹ã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã¦ã„ãªãã¦ã‚‚æ”»æ’ƒãŒå¯èƒ½ã§ã™ã®ã§ã€XPã‚’ä½¿ã£ã¦ã„ã‚‹æ–¹ã‚‚æ²¹æ–ã—ã¦ã¯ã„ã‘ã¾ã›ã‚“ã€‚ [Windows XPã§IE8ã®è„†å¼±æ€§ã‚’æ‚ªç”¨ã—é›»å“ã‚’èµ·å‹•ã—ãŸã¨ã“ã‚] æ”»æ’ƒãŒç°¡å˜ãªç†ç”±ã¯ã€Windows 7ã§ã¯ASLRã¨ã„ã£ã¦ãƒ¡ãƒ¢ãƒª
ori53 2013/10/09
security

vulnerability
ãƒªãƒ³ã‚¯
JVNVU#94473961: ãƒžãƒ«ãƒã‚³ã‚¢ CPU ã®å…±æœ‰ L3 ã‚ãƒ£ãƒƒã‚·ãƒ¥ã«å¯¾ã™ã‚‹ã‚µã‚¤ãƒ‰ãƒãƒ£ãƒãƒ«æ”»æ’ƒ
å½±éŸ¿ã‚’å—ã‘ã‚‹è£½å“ã¯è¤‡æ•°å˜åœ¨ã—ã¾ã™ã€‚è©³ã—ãã¯ã€CERT/CC Vulnerability Note VU#976534 ã‚’ã”ç¢ºèªãã ã•ã„ã€‚ ãƒžãƒ«ãƒã‚³ã‚¢ CPU ã®å…±æœ‰ L3 ã‚ãƒ£ãƒƒã‚·ãƒ¥ã«å¯¾ã™ã‚‹ã‚µã‚¤ãƒ‰ãƒãƒ£ãƒãƒ«æ”»æ’ƒæ‰‹æ³•ãŒå…¬é–‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ è©³ã—ãã¯ã€Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack ã‚’ã”ç¢ºèªãã ã•ã„ã€‚ ã“ã®å•é¡Œã¯æƒ…å ±æ¼ãˆã„ (CWE-200) ã®è„†å¼±æ€§ã®ä¸€ç¨®ã§ã™ã€‚ å…±æœ‰ L3 ã‚ãƒ£ãƒƒã‚·ãƒ¥ã‚’é€šã˜ã¦ã€ä»–ã®ãƒ—ãƒã‚»ã‚¹ã‹ã‚‰ãƒ¡ãƒ¢ãƒªå†…å®¹ã‚’æŽ¨æ¸¬ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚çµæžœã¨ã—ã¦ã€æ©Ÿå¯†æƒ…å ±ãªã©ã‚’å–å¾—ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ Flush+Reload: a High Resolution, Low Noise, L3 Cache Side-Channel Attack ã§ã¯ã€Intel Ivy Bridg
ori53 2013/10/08
security

vulnerability
ãƒªãƒ³ã‚¯
OpenVAS - Open Vulnerability Assessment Scanner
Greenbone OpenVAS OpenVAS is a full-featured vulnerability scanner. Its capabilities include unauthenticated and authenticated testing, various high-level and low-level internet and industrial protocols, performance tuning for large-scale scans and a powerful internal programming language to implement any type of vulnerability test. The scanner obtains the tests for detecting vulnerabilities from
ori53 2012/08/17
security

vulnerability

openvas
ãƒªãƒ³ã‚¯
1