We just got
credits
for a flaw we found in SAP Netweaver. The issue is a reflected
Cross-Site Scripting
(XSS). It can be triggered in the administrative interface for the Internet
Communication Manager (ICM) and Web Dispatcher. This means that the targets for
this XSS will definitely be users with administrative privileges. This makes it
especially juicy for an attacker.
SAP rated the vulnerability with CVSS and a Base Score of 4.3 having a Base
Vector of AV:N/AC:M/AU:N/C:N/I:P/A:N. Which again opens the discussion on how
to rate the impact of XSS by using CVSS. CVSS
states that XSS
“should be scored with no impact to confidentiality or availability, and
partial impact to integrity“, which is clearly arguable. Especially when
thinking of the impact on confidentiality. As you might know by now, we tried to
tackle the problem of rating vulnerabilities ourselves with the
ERNW Rapid Rating System
(ERRS) and it was not an easy task. 😉 However, SAP states that this is a
correction with high priority, so you should apply the patches as soon as
possible.
This is the second part of the – presumably – three-part series on IPv6 address
planning which I started
here.
Before an enterprise organization (strictly speaking “their internal service
provider acting as LIR”, as laid out in the first part) starts assigning
prefix[es]/lengths to their networks usually another discussion has to be
undertaken & solved: “go with one /32 [PI space] from one RIR or apply for
/32s from several RIRs”.
Today we have to pleasure to announce another round of
Troopers talks.
Here we go:
Noam Liram: Vulnerability Classification in the SaaS Era FIRST TIME
MATERIAL
Abstract: In this talk we will thoroughly analyze two major SaaS vulnerabilities
that were found by Adallom (one of which is still in responsible disclosure
stages at the time of writing). By demonstrating this new class of exploits
which we have nick-named “Ice Dagger” attacks, we aim to change the current
industry-wide criteria for vulnerability classifications, which were developed
in the Desktop/Server world, are inadequate when classifying SaaS
vulnerabilities. We will specifically discuss the details of MS13-104.
In the course of our virtualization research, we came across a certain technical
issue we couldn’t find an easy solution on knowledge bases and the like.
However, as we found the question several times on the web, the following post
gives just a short hint on a technical detail.
If you want to connect two virtual machines in VMware Fusion using a serial port
(e.g. for debugging purposes), Fusion doesn’t provide you an GUI option to
configure that. However, if you just add the following config to the debugger
system’s VMX file:
During a recent research project we performed an in-depth security assessment of
Microsoft’s virtualization technologies, including Hyper-V and Azure. While we
already had experience in discovering security vulnerabilities in other virtual
environments (e.g.
here and
here), this was
our first research project on the Microsoft virtualization stack and we took
care to use a
structured evaluation strategy
to cover all potential attack vectors.
Part of our research concentrated on the Hyper-V hypervisor itself and we
discovered a critical vulnerability which can be exploited by an unprivileged
virtual machine to crash the hypervisor and potentially compromise other virtual
machines on the same physical host. This bug was recently patched, see
MS13-092 and
our
corresponding post.
continuing our tradition from last year (see
here and
here), we
summarized more of our hardening recommendations for you. This guide is covering
Tomcat 7 and is supposed to provide a solid base of hardening measures. It
includes configuration examples and all necessary commands for each control,
specifically for the most recent branch of Tomcat as there were some significant
changes.
Download: ERNW_Checklist_Tomcat7_Hardening.pdf
In an upcoming series of blog posts I will discuss some principles &
considerations on developing an IPv6 address plan. In (hopefully) rather quick
succession there will be three posts:
the first on some general rules as for IPv6 address planning which we regard
instrumental in the process.
the second covering the “PI space from a single RIR or PI space from each
(relevant, as for $ORG) RIR?” debate.
the third on actual approaches to structuring/grouping each region’s /32 (or
/36) into subdivisions like sites, VRFs, facilities, use types, buildings,
whatever. I understand that this part is probably the one quite some readers
are most interested in; still for a reasonable line of thought the others have
to be covered in advance.
As you might have already spotted from the prefix lengths mentioned above, the
presumed setting (read: the main audience) of this piece is a sufficiently large
enterprise organization with sites/subsidiaries/plants all over the globe,
potentially mainly in the EMEA, APAC and Americas regions. So if you’re [with]
a service provider organization, a university or small[er] organization, some
of the recommendations I lay out might not apply to you. This focus (or
restriction thereof) is for the simple reason of ignorance. Given I haven’t been
involved in many address planning efforts in such organizations I don’t feel
qualified to advance opinions on their settings.
We wish you a happy new year and a good start to 2014. A new year has begun and,
just before that, 30C3 took place. I think almost all of you have heard about
the congress and its topics. In particukar there was Glenn Greenwald’s
keynote or
there were new
publications/revelations
by Jacob Appelbaum, which you will probably have heard about from main media.
But besides of all that, there were really a lot of other interesting talks we
want to give you a short introduction to. Overall it was a really good
conference this year and a lot of awesome talks. But, like always, it is not
possible to see all of them, so here is a short summary of some of our
favorites:
First of all, I hope you all had a good start to 2014. Having some time off
“between the years” (which is a German saying for the time between Christmas and
NYE), I caught up on several virtualization security topics.
While virtualization is widely accepted as a sufficiently secure technology in
many areas of IT operations (also for sensitive applications or exposed systems,
like
DMZs)
by 2014, there are several recent vulnerabilities and incidents that are worth
mentioning.
At first a very happy new year to all our readers!
Today we announce the third round of Troopers 2014 talks (first round
here,
second
here).
Here we go:
===
Daniel Mende: Implementing an USB Host Driver Fuzzer FIRST TIME
MATERIAL
Abstract: The Universal Serial Bus (USB) can be found everywhere these days, may
it be to connect a mouse or keyboard to the computer, transfer data on a flash
drive connected via USB or to attach some additional hardware like a Digital
Video Broadcast receiver. Some of these devices use a standardized device class
which are served by an operating system default driver while other, special
purpose devices, do not fit into any of those classes, so vendors ship their own
drivers. As every vendor specific USB driver installed on a system adds
additional attack surface, there needs to be some method to evaluate the
stability and the security of those vendor proprietary drivers. The simplest way
to perform a stability analysis of closed source products is the fuzzing
approach. As there have been no publicly available tools for performing USB host
driver fuzzing, I decided to develop one ;-), building on Sergey’s and Travis’
legendary
Troopers13 talk.
Be prepared to learn a lot about USB specifics, and to see quite a number of
blue screens and stack traces on major server operating systems…