This post covers 2022-08-15 to 2022-08-22.
Vulnerabilities#
CVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflow#
In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remotely execute code without authentication via a crafted SIP packet that contains malicious SDP data.
- https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2022-27255.pdf
- https://github.com/infobyte/cve-2022-27255
- https://socradar.io/exploit-code-of-critical-realtek-sdk-vulnerability-released/
Apple fixes two 0days#
Apple released patches for two publicly exploited vulnerabilities. CVE-2022-32893 is an out-of-bounds write in WebKit. Maliciously crafted web content might lead to arbitrary code execution. The second vulnerability CVE-2022-32894 is an out-of-bands write in the kernel. An application may be able to execute arbitrary code with kernel privileges. Both vulnerabilities probably been discovered in targeted attacks.
Chrome 0day#
A new release of Chrome includes a patch for CVE-2022-2856. It is based on insufficient validation of untrusted input in Intents. Intents are used to launch apps and can provide additional data. If an intent contains any extras or a data URI and it targets another browser, Google Chrome would open that browser with that URL without prompting The vulnerability was discovered via Google Threat Analysis Group (TAG). Further details on specific threat actors have not been released so far.
- Chrome Releases: Stable Channel Update for Desktop
- Ensure prompt is shown for any data intents targeting other browsers (I93539196) · Gerrit Code Review
News#
241 npm and PyPI packages caught dropping Linux cryptominers#
Tools#
- Threatest - Threatest is a Go framework for end-to-end testing threat detection rules
- Phishing Catcher - Catch possible phishing domains in near real time by looking for suspicious TLS certificate issuances reported to the Certificate Transparency Log (CTL) via the CertStream API
- DNSObserver - A handy DNS service written in Go to aid in the detection of several types of blind vulnerabilities
- Pickl3 - Pickl3 is Windows active user credential phishing tool