資安新聞及事件週報 2017/4/10 ~ 2017/4/14

資安新聞及事件週報  2017/4/10 ~ 2017/4/14

1.重大弱點漏洞
  Microsoft Office Word 版本之物件連結與嵌入(OLE) 存在零時差漏洞
  http://www.nccst.nat.gov.tw/VulnerabilityDetail?lang=zh&seq=1056
  http://www.ithome.com.tw/news/113340
  https://www.cybersecurity-help.cz/vdb/SB2017040901
  https://www.fireeye.com/blog/threat-research/2017/04/acknowledgement_ofa.html
  https://securingtomorrow.mcafee.com/mcafee-labs/critical-office-zero-day-attacks-detected-wild
  https://support.office.com/en-us/article/What-is-Protected-View-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653
  http://thehackernews.com/2017/04/microsoft-word-zero-day.html


  McAfee：駭客以零時攻擊程式入侵微軟系統漏洞，影響所有Office用戶
  http://www.ithome.com.tw/news/113340
  
  儘快安裝修補程式！微軟 Word 漏洞影響上百萬人
  http://technews.tw/2017/04/12/word-zero-day-vulnerability-affect-millions-it-should-be-update-and-packed-immediately/


  微軟發佈安全更新，其中包含Office零時差漏洞
  https://technet.microsoft.com/en-us/security/bulletins.aspx
  https://www.fireeye.com/blog/threat-research/2017/04/cve-2017-0199-hta-handler.html


  Openbsd 漏洞 CVE-2017-5850
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5850


  NTP 漏洞 CVE-2017-6463
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6463


  WebKitGTK+ Late TLS 漏洞
  https://webkitgtk.org/security/WSA-2015-0002.html


  AlienVault OSSIM和USM身份驗證繞過漏洞
  https://www.alienvault.com/forums/discussion/7765/alienvault-v5-3-1-hotfix

資安新聞及事件週報 2017/4/3 ~ 2017/4/7

資安新聞及事件週報  2017/4/3 ~ 2017/4/7

1.重大弱點漏洞
  VMware修補了被駭客競賽pwn2own攻陷的4個漏洞
  http://www.ithome.com.tw/news/113171


  Adobe Acrobat Force-Installed Vulnerable Chrome Extension
  https://www.seebug.org/vuldb/ssvid-92859


  技嘉兩款迷你準系統UEFI韌體遭爆有漏洞，有被植入勒贖軟體風險
  http://www.ithome.com.tw/news/113231


  Splunk 修復安全漏洞：誘導用戶訪問惡意網站，洩露個人信息
  http://hackernews.cc/archives/8370
 
  Splunk Enterprise 多個漏洞 CVE-2017-5607
  http://securitytracker.com/
  http://www.splunk.com/view/SP-CAAAPZ3


  That sound you hear is Splunk leaking data
  http://go.theregister.com/feed/www.theregister.co.uk/2017/04/03/that_sound_you_hear_is_splunk_leaking_data/


  安全審計人員發現16項NTP安全漏洞
  http://www.ifuun.com/a2017411559497/

資安新聞及事件週報 2017/3/27 ~ 2017/3/31

資安新聞及事件週報  2017/3/27 ~ 2017/3/31

1.重大弱點漏洞
  Cisco AsyncOS 漏洞
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170315-wsa


  NTP拒絕服務漏洞(CVE-2016-9042)
  http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9042


  Trend_Micro Endpoint_Sensor漏洞 CVE-2017-6798
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6798


  Mikrotik Router hap lite firmware 漏洞 CVE-2017-6444
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6444


  Trend_Micro Interscan Messaging Security Virtual Appliance 漏洞 CVE-2017-6398
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6398

資安新聞及事件週報 2017/3/20 ~ 2017/3/24

資安新聞及事件週報  2017/3/20 ~ 2017/3/24

1.重大弱點漏洞
  3秒攻破Adobe公司閱讀器 挖出蘋果系統「骨灰級」漏洞
  http://news.sina.com.tw/article/20170318/21148926.html


  ASUS    RT-AC53漏洞 CVE-2017-6548 CVE-2017-6549
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6548
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6549


  D-Link DI-524 漏洞 CVE-2017-5633
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5633


  IBM QRadar Security Information and Event Manager漏洞 CVE-2016-9726 CVE-2016-9727 CVE-2016-9740
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9726
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9727
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2016-9740


  Netgear Dgn2200 series firmware  漏洞 CVE-2017-6334
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6334

資安新聞及事件週報 2017/3/13 ~ 2017/3/17

資安新聞及事件週報  2017/3/13 ~ 2017/3/17

1.重大弱點漏洞
  A10 AX1030 漏洞
  https://www.a10networks.com/blog/cve-2016-0270-gcm-nonce-vulnerability


  Linux修補了存在已有7年的可擴張使用者權限漏洞
  http://www.ithome.com.tw/news/112816


  D-Link 路由器多個漏洞 CVE-2017-3191 CVE-2017-3192 CVE-2017-3193
  http://www.kb.cert.org/vuls/id/305448
  http://www.kb.cert.org/vuls/id/553503


  IBM WebSphere Application 伺服器權限提升漏洞 CVE-2017-1151
  http://securitytracker.com/id/1037984
  http://www-01.ibm.com/support/docview.wss?uid=swg21999293


  VMware 產品遠端程式碼執行漏洞 CVE-2017-4901
  https://www.us-cert.gov/ncas/current-activity/2017/03/14/VMware-Releases-Security-Updates
  http://www.vmware.com/security/advisories/VMSA-2017-0005.html


  Veritas Netbackup appliance CVE-2017-6403 CVE-2017-6409
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6403
  http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-6409

資安新聞及事件週報 2017/3/6 ~ 2017/3/10

資安新聞及事件週報  2017/3/6 ~ 2017/3/10

1.重大弱點漏洞
  Tenable Nessus 漏洞
  http://securitytracker.com/id/1037887


  IBM iNotes 漏洞
  http://www-01.ibm.com/support/docview.wss?uid=swg21997010


  Apache Struts2 遠端執行程式碼漏洞
  http://www.cert.org.cn/publish/main/9/2017/20170307143036394110259/20170307143036394110259_.html


  Symantec Endpoint Protection 多個漏洞
  https://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=&suid=20170306_00


  EXPLOITEE.RS 揭露WD MY CLOUD 系列NAS 存在安全漏洞
  https://news.xfastest.com/wd/32237/exploitee-rs-wd-my-cloud-nas/

資安新聞及事件週報 2017/2/27 ~ 2017/3/3

資安新聞及事件週報  2017/2/27 ~ 2017/3/3

1.重大弱點漏洞
  多款TP-Link路由器存在多個漏洞
  https://pierrekim.github.io/blog/2017-02-09-tplink-c2-and-c20i-vulnerable.html


  Java、Python安全漏洞可能讓攻擊者繞過防火牆
  http://www.ithome.com.tw/news/112310


  Linux kernel tcp_splice_read 漏洞（CVE-2017-6214）
  http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ccf7abb93af09ad0868ae9033d1ca8108bdaec82
 
  Drupal Facebook Pull 漏洞
  https://www.drupal.org/node/2850873
 
  IBM WebSphere Application Server 多個漏洞
  https://www.ibm.com/support/docview.wss?uid=swg21998379


  Joomla Joomloc-CAT組件'ville'漏洞
  https://www.exploit-db.com/exploits/41383/