Remote Code Execution Vulnerability found in Oracle Weblog (again)

On 18 June 2019, Oracle released a security advisory detailing a vulnerability in their WebLogic software. The vulnerability resides in WebLogic's XMLDecoder deserialization logic. A specialized packet can be sent to WebLogic to trigger this vulnerability which can result in remote code execution with no authentication reqiured. The CVSS score is 9.8 out of 10.

Recommendations

• Apply the patches for CVE-2019-2729
• Consider enabling Cyber Attack Chatter in the platform to monitor chatter related to this vulnerability

Details

A blog post by Oracle outlined that this vulnerability is a distinct vulnerability from another deserialization bug released earlier this year, CVE-2019-2725. Oracle released the patch for CVE-2019-2729 out of band and not on their regular patch schedule. This could point to evidence of the vulnerability being exploited in the wild, which was exactly what happened with CVE-2019-2725, where attackers were using it to drop the Sodinokibi ransomware family.

Linux Kernel TCP Stack Vulnerabilities Disclosed by Netflix

On 17 June 2019, the Netflix security research team released an advisory detailing multiple vulnerabilities in the TCP-stack for the Linux and FreeBSD kernels. The vulnerabilities affect how these kernels interact and process specially crafted minimum segment size (MSS) and TCP Selective Acknowledgement (SACK) capabilities. Netflix claims the most serious of the vulnerabilities, dubbed "SACK Panic", can be used to remotely trigger a kernel panic on recent Linux kernels.

Recommendations

• Apply the patches for CVE-2019-11477,11478,11479 and 5599 listed on the linked advisory
• Consider enabling Cyber Attack Chatter in the platform to monitor chatter related to these vulnerabilities
• If you cannot patch, consider the "Workarounds" on the linked advisory

Details

SACK is a standard under RFC-2018 which allows servers in a TCP connection to selectively acknowledge TCP packets to their clients in the case of dropped packets. MSS allows clients to specify the total amount of data contained in a reconstructed TCP segment. By manipulating small MSS sizes, the researchers abused these two features within Linux and FreeBSD kernels to exhaust the processing power of vulnerable servers. Successful exploitation of these CVEs may result in a DDoS. In the case of the most severe vulnerability, CVE-2019-11477, a kernel panic may be triggered.

The researchers released patches on their advisory on Github. 2 of the 4 vulnerabilities have a patch and 2 workarounds, while the remaining 2 have 1 workaround.

Breach Disclosure: D3Scene

D3Scene, a gaming website and forum, was breached in January 2016. The forum is known for discussions on how to cheat in online video games, bypass various anti-cheat gaming clients and how to abuse these various platforms. The breach data contained approximately 568,000 rows of email addresses, IP addresses, salted md5 passwords and usernames.

Recommendations

• If not already enabled, turn on the compromised credentials rule for all relevant entities and ensure relevant emails are entered for those entities, or reach out to [email protected] for assistance
• If one of your entities receives an alert ZeroFOX recommends immediate password changes for the affected account
• Enable 2-factor authentication for all of your organizational accounts to help mitigate phishing and credential stuffing attacks
• Remain alert to potential spear phishing attacks through email and social media.

Details

The passwords were stored in salted md5 format, which helps protect against brute force attacks. Md5 has known weaknesses that reduce the search space for brute force significantly, so the format is still not ideal for protecting user data.

A recent thread on the forum by user Sifex talked about the breach being added to Have I Been Pwned. The user questioned why D3Scene does not force https on the website. An administrator's hand-wavy reply did not address the forced-https question:

I think we were aware of that breach and prompted every user to create a new password which we did continuously for a good amount of time.

On top of that we updated the forum software again to prevent future hacks.