Ó¡¶ÈÕþ¸®»ú¹¹ÒâÍâй¶1250ÍòÓÐÉíÅ®ÐÔµÄÒ½ÁÆÐÅÏ¢£»£»£»£»2.6Íò¸öKibanaʵÀý£»£»£»£»1.35Íò¸öiSCSI´æ´¢¼¯Èº

Ðû²¼Ê±¼ä 2019-04-03
1.Ñо¿Ö°Ô±·¢Ã÷Áè¼Ý2.6Íò¸öKibanaʵÀýÔÚÍøÉÏ̻¶


¼øºÚµ£±£Íø(jhdbw)¡¤×î¾ßȨÍþΨһάȨµ£±£Æ½Ì¨


Ñо¿Ö°Ô±·¢Ã÷Áè¼Ý2.6Íò¸öKibanaʵÀýÔÚÍøÉÏ̻¶¡£¡£¡£¡£¡£KibanaÊÇÒ»¸ö¿ªÔ´µÄÆÊÎöºÍ¿ÉÊÓ»¯Æ½Ì¨£¬£¬£¬Ö¼ÔÚʵʱÆÊÎöElasticsearchÊý¾Ý¿âÖеÄÊý¾Ý¡£¡£¡£¡£¡£´ó´ó¶¼Ì»Â¶µÄʵÀý¶¼Ã»ÓÐÊܵ½±£»£»£»£»¤£¬£¬£¬ÔÊÐíδ¾­Éí·ÝÑéÖ¤µÄÓû§»á¼ûÒDZíÅÌ¡£¡£¡£¡£¡£ÕâЩʵÀýÊôÓÚµç×Óѧϰƽ̨¡¢ÒøÐÐϵͳ¡¢Í£³µÖÎÀíϵͳ¡¢Ò½ÔººÍ´óѧµÈ´óÐÍ»ú¹¹£¬£¬£¬ÃÀ¹ú£¨8311¸ö£©ÊÇ̻¶ʵÀý×î¶àµÄ¹ú¼Ò£¬£¬£¬Æä´ÎÊÇÖйú£¨7282£©¡¢µÂ¹ú£¨1709£©ºÍ·¨¹ú£¨1152£©¡£¡£¡£¡£¡£±ðµÄ£¬£¬£¬Ðí¶àʵÀý¶¼ÔËÐйýʱµÄÈí¼þ°æ±¾£¨±£´æí§ÒâÎļþ°üÀ¨Îó²î£©¡£¡£¡£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://thehackernews.com/2019/04/kibana-data-security.html

2.Áè¼Ý1.35Íò¸öiSCSI´æ´¢¼¯ÈºÒòÉèÖùýʧÔÚÍøÉÏ̻¶


¼øºÚµ£±£Íø(jhdbw)¡¤×î¾ßȨÍþΨһάȨµ£±£Æ½Ì¨


Çå¾²Ñо¿Ö°Ô±A Shadow·¢Ã÷Áè¼Ý1.35Íò¸öiSCSI´æ´¢¼¯ÈºÒòÉèÖùýʧÔÚÍøÉÏ̻¶¡£¡£¡£¡£¡£ÕâЩ¼¯ÈºÒòδÆôÓÃÉí·ÝÑéÖ¤£¬£¬£¬µ¼Ö·¸·¨·Ö×Ó¿ÉÒÔͨ¹ý»¥ÁªÍø»á¼ûÕâЩ´ÅÅÌÕóÁкÍNAS×°±¸£¬£¬£¬Ê¹µÃÆóÒµµÄÃô¸ÐÊý¾ÝÃæÁÙΣº¦¡£¡£¡£¡£¡£ÕâЩiSCSI¼¯ÈºÊôÓÚ˽Ӫ¹«Ë¾¡¢Õþ¸®»ú¹¹¡¢´óѧºÍÑо¿»ú¹¹µÈ£¬£¬£¬ÊÇÍøÂç·¸·¨¼¯ÍŵÄÀíÏë¹¥»÷Ä¿µÄ¡£¡£¡£¡£¡£


Ô­ÎÄÁ´½Ó£º
https://www.zdnet.com/article/over-13k-iscsi-storage-clusters-left-exposed-online-without-a-password/

3.ŦԼÊ׸®°Â¶û°ÍÄáÊÐÔâÀÕË÷Èí¼þ¹¥»÷£¬£¬£¬ËðʧÈÔÔÚÆÀ¹ÀÖÐ

¼øºÚµ£±£Íø(jhdbw)¡¤×î¾ßȨÍþΨһάȨµ£±£Æ½Ì¨

ÃÀ¹úŦԼÖÝÊ׸®°Â¶û°ÍÄáÊÐÓÚ3ÔÂ30ÈÕÔâµ½ÀÕË÷Èí¼þ¹¥»÷£¬£¬£¬Ä¿½ñÈÔ²»ÇåÎúÆäÅÌËã»úϵͳµÄÊÜËðˮƽ£¬£¬£¬µ«Æ¾Ö¤¸ÃÊйÙÍøÐû²¼µÄÐÂΟ壬£¬£¬ËùÓеͼ»áЧÀͶ¼ÒÑ¿ÉÓ㬣¬£¬µ«³öÉú֤ʵ¡¢éæÃü֤ʵºÍÍê»éÖ¤ÊéЧÀͳýÍâ¡£¡£¡£¡£¡£Ã»ÓÐÖ¤¾ÝÅúעСÎÒ˽¼ÒÊý¾ÝÊÜË𣬣¬£¬µ«¶¼»áµÄн×ÊЧÀÍÊܵ½Ó°Ï죬£¬£¬²»¿ÉÈ·¶¨¸ÃÊÐÊÇ·ñ»áÖ§¸¶Êê½ð¡£¡£¡£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://www.bleepingcomputer.com/news/security/new-york-albany-capital-hit-by-ransomware-attack/

4.Ó¡¶ÈÕþ¸®»ú¹¹ÒâÍâй¶1250ÍòÓÐÉíÅ®ÐÔµÄÒ½ÁÆÐÅÏ¢

¼øºÚµ£±£Íø(jhdbw)¡¤×î¾ßȨÍþΨһάȨµ£±£Æ½Ì¨


3Ô³õSecurity DiscoveryµÄÇå¾²Ñо¿Ô±Bob Diachenko·¢Ã÷Ó¡¶È±±²¿Ò»¸öÖݵÄÕþ¸®Ò½ÁƲ¿·ÖÒâÍâй¶Áè¼Ý1250Íò·ÝÔи¾µÄÒ½ÁƼͼ£¬£¬£¬ÕâЩ¼Í¼°üÀ¨ÐÕÃû¡¢µØµã¡¢ÄêËê¡¢µç»°¡¢Õï¶ÏºÍ¼²²¡ÐÅÏ¢¡¢ÈÑÉï״̬¡¢ÈÑÉï²¢·¢Ö¢¡¢USG/ÑòĤ´©´Ì/»ùÒò¼ì²âÐÅÏ¢¡¢º¢×ӵĸ¸Ç×ÐÕÃûµÈ¡£¡£¡£¡£¡£ÕâЩ¼Í¼×îÔç¿É×·ËÝÖÁ2014Äê¡£¡£¡£¡£¡£¸ÃÊý¾Ý¿âÔÚδÉèÃÜÂëµÄÇéÐÎÏÂÅþÁ¬µ½»¥ÁªÍø£¬£¬£¬²¢ÔÚÍøÂçÉÏ̻¶ÁËÁè¼Ý3ÖܵÄʱ¼ä¡£¡£¡£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://www.zdnet.com/article/indian-govt-agency-left-details-of-millions-of-pregnant-women-exposed-online/

5¡£¡£¡£¡£¡£GoogleÐû²¼4ÔÂAndroidÇå¾²¸üУ¬£¬£¬ÐÞ¸´¶à¸öÎó²î

¼øºÚµ£±£Íø(jhdbw)¡¤×î¾ßȨÍþΨһάȨµ£±£Æ½Ì¨


GoogleÐû²¼4ÔÂAndroidÇå¾²¸üУ¬£¬£¬ÔÚÇå¾²²¹¶¡¼¶±ð2019-04-01ÖУ¬£¬£¬GoogleÐÞ¸´ÁËÁ½¸ö¸ßΣRCEÎó²îºÍ9¸öÌáȨ£¨EoP£©¼°ÐÅϢй¶£¨ID£©Îó²î¡£¡£¡£¡£¡£ÕâÁ½¸öRCEÎó²îÊÇýÌå¿ò¼Ü×é¼þÖеÄÎó²î£¨CVE-2019-2027ºÍCVE-2019-2028£©£¬£¬£¬¿Éµ¼ÖÂí§Òâ´úÂëÖ´ÐУ¬£¬£¬Android 7.0¼°Ö®ºóµÄ°æ±¾¶¼ÊÜÓ°Ïì¡£¡£¡£¡£¡£ÁíÒ»¸öÇå¾²²¹¶¡¼¶±ðÊÇ2019-04-05£¬£¬£¬½¨ÒéÓû§¾¡¿ì×°ÖÃÕâЩ¸üС£¡£¡£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://www.bleepingcomputer.com/news/security/google-fixes-two-critical-android-code-execution-vulnerabilities/

6.ApacheÐû²¼Ð°汾2.4.39£¬£¬£¬ÐÞ¸´¶à¸öÎó²î


¼øºÚµ£±£Íø(jhdbw)¡¤×î¾ßȨÍþΨһάȨµ£±£Æ½Ì¨


Apache HTTP Server 2.4.39ÖÐÐÞ¸´Á˶à¸öÇå¾²Îó²î£¬£¬£¬×îΪÑÏÖØµÄÎó²îÊÇÌáȨÎó²î£¨CVE-2019-0211£©£¬£¬£¬¸ÃÎó²îÓ°ÏìÁË2.4.17µ½2.4.38Ö®¼äµÄËùÓа汾£¬£¬£¬ÔÊÐí¾ßÓо籾дÈëºÍÔËÐÐȨÏÞµÄÓû§»ñµÃrootȨÏÞ²¢Ö´ÐÐí§Òâ´úÂë¡£¡£¡£¡£¡£±ðµÄ£¬£¬£¬¸Ã°æ±¾»¹ÐÞ¸´ÁË»á¼û¿ØÖÆÈƹýÎó²î£¨CVE-2019-0217ºÍCVE-2019-0215£©¡¢¿ÉÄܵ¼ÖÂÍß½âµÄÎó²î£¨CVE-2019-0197£©¡¢read-after-freeÎó²î£¨CVE-2019-0196£©ºÍURL¹æ·¶»¯·×ÆçÖÂÎó²î£¨CVE-2019-0220£©¡£¡£¡£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://www.bleepingcomputer.com/news/security/apache-bug-lets-normal-users-gain-root-access-via-scripts/