Ó¡¶ÈÕþ¸®»ú¹¹ÒâÍâй¶1250ÍòÓÐÉíÅ®ÐÔµÄÒ½ÁÆÐÅÏ¢£»£»£»£»£»£»2.6Íò¸öKibanaʵÀý£»£»£»£»£»£»1.35Íò¸öiSCSI´æ´¢¼¯Èº

Ðû²¼Ê±¼ä 2019-04-03
1.Ñо¿Ö°Ô±·¢Ã÷Áè¼Ý2.6Íò¸öKibanaʵÀýÔÚÍøÉÏ̻¶


¿­·¢¡¤k8(ÖйúÓÎ)¹Ù·½ÍøÕ¾


Ñо¿Ö°Ô±·¢Ã÷Áè¼Ý2.6Íò¸öKibanaʵÀýÔÚÍøÉÏ̻¶¡£¡£¡£KibanaÊÇÒ»¸ö¿ªÔ´µÄÆÊÎöºÍ¿ÉÊÓ»¯Æ½Ì¨£¬£¬£¬£¬£¬Ö¼ÔÚʵʱÆÊÎöElasticsearchÊý¾Ý¿âÖеÄÊý¾Ý¡£¡£¡£´ó´ó¶¼Ì»Â¶µÄʵÀý¶¼Ã»ÓÐÊܵ½±£»£»£»£»£»£»¤£¬£¬£¬£¬£¬ÔÊÐíδ¾­Éí·ÝÑéÖ¤µÄÓû§»á¼ûÒDZíÅÌ¡£¡£¡£ÕâЩʵÀýÊôÓÚµç×Óѧϰƽ̨¡¢ÒøÐÐϵͳ¡¢Í£³µÖÎÀíϵͳ¡¢Ò½ÔººÍ´óѧµÈ´óÐÍ»ú¹¹£¬£¬£¬£¬£¬ÃÀ¹ú£¨8311¸ö£©ÊÇ̻¶ʵÀý×î¶àµÄ¹ú¼Ò£¬£¬£¬£¬£¬Æä´ÎÊÇÖйú£¨7282£©¡¢µÂ¹ú£¨1709£©ºÍ·¨¹ú£¨1152£©¡£¡£¡£±ðµÄ£¬£¬£¬£¬£¬Ðí¶àʵÀý¶¼ÔËÐйýʱµÄÈí¼þ°æ±¾£¨±£´æí§ÒâÎļþ°üÀ¨Îó²î£©¡£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://thehackernews.com/2019/04/kibana-data-security.html

2.Áè¼Ý1.35Íò¸öiSCSI´æ´¢¼¯ÈºÒòÉèÖùýʧÔÚÍøÉÏ̻¶


¿­·¢¡¤k8(ÖйúÓÎ)¹Ù·½ÍøÕ¾


Çå¾²Ñо¿Ö°Ô±A Shadow·¢Ã÷Áè¼Ý1.35Íò¸öiSCSI´æ´¢¼¯ÈºÒòÉèÖùýʧÔÚÍøÉÏ̻¶¡£¡£¡£ÕâЩ¼¯ÈºÒòδÆôÓÃÉí·ÝÑéÖ¤£¬£¬£¬£¬£¬µ¼Ö·¸·¨·Ö×Ó¿ÉÒÔͨ¹ý»¥ÁªÍø»á¼ûÕâЩ´ÅÅÌÕóÁкÍNAS×°±¸£¬£¬£¬£¬£¬Ê¹µÃÆóÒµµÄÃô¸ÐÊý¾ÝÃæÁÙΣº¦¡£¡£¡£ÕâЩiSCSI¼¯ÈºÊôÓÚ˽Ӫ¹«Ë¾¡¢Õþ¸®»ú¹¹¡¢´óѧºÍÑо¿»ú¹¹µÈ£¬£¬£¬£¬£¬ÊÇÍøÂç·¸·¨¼¯ÍŵÄÀíÏë¹¥»÷Ä¿µÄ¡£¡£¡£


Ô­ÎÄÁ´½Ó£º
https://www.zdnet.com/article/over-13k-iscsi-storage-clusters-left-exposed-online-without-a-password/

3.ŦԼÊ׸®°Â¶û°ÍÄáÊÐÔâÀÕË÷Èí¼þ¹¥»÷£¬£¬£¬£¬£¬ËðʧÈÔÔÚÆÀ¹ÀÖÐ

¿­·¢¡¤k8(ÖйúÓÎ)¹Ù·½ÍøÕ¾

ÃÀ¹úŦԼÖÝÊ׸®°Â¶û°ÍÄáÊÐÓÚ3ÔÂ30ÈÕÔâµ½ÀÕË÷Èí¼þ¹¥»÷£¬£¬£¬£¬£¬Ä¿½ñÈÔ²»ÇåÎúÆäÅÌËã»úϵͳµÄÊÜËðˮƽ£¬£¬£¬£¬£¬µ«Æ¾Ö¤¸ÃÊйÙÍøÐû²¼µÄÐÂΟ壬£¬£¬£¬£¬ËùÓеͼ»áЧÀͶ¼ÒÑ¿ÉÓ㬣¬£¬£¬£¬µ«³öÉú֤ʵ¡¢éæÃü֤ʵºÍÍê»éÖ¤ÊéЧÀͳýÍâ¡£¡£¡£Ã»ÓÐÖ¤¾ÝÅúעСÎÒ˽¼ÒÊý¾ÝÊÜË𣬣¬£¬£¬£¬µ«¶¼»áµÄн×ÊЧÀÍÊܵ½Ó°Ï죬£¬£¬£¬£¬²»¿ÉÈ·¶¨¸ÃÊÐÊÇ·ñ»áÖ§¸¶Êê½ð¡£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://www.bleepingcomputer.com/news/security/new-york-albany-capital-hit-by-ransomware-attack/

4.Ó¡¶ÈÕþ¸®»ú¹¹ÒâÍâй¶1250ÍòÓÐÉíÅ®ÐÔµÄÒ½ÁÆÐÅÏ¢

¿­·¢¡¤k8(ÖйúÓÎ)¹Ù·½ÍøÕ¾


3Ô³õSecurity DiscoveryµÄÇå¾²Ñо¿Ô±Bob Diachenko·¢Ã÷Ó¡¶È±±²¿Ò»¸öÖݵÄÕþ¸®Ò½ÁƲ¿·ÖÒâÍâй¶Áè¼Ý1250Íò·ÝÔи¾µÄÒ½ÁƼͼ£¬£¬£¬£¬£¬ÕâЩ¼Í¼°üÀ¨ÐÕÃû¡¢µØµã¡¢ÄêËê¡¢µç»°¡¢Õï¶ÏºÍ¼²²¡ÐÅÏ¢¡¢ÈÑÉï״̬¡¢ÈÑÉï²¢·¢Ö¢¡¢USG/ÑòĤ´©´Ì/»ùÒò¼ì²âÐÅÏ¢¡¢º¢×ӵĸ¸Ç×ÐÕÃûµÈ¡£¡£¡£ÕâЩ¼Í¼×îÔç¿É×·ËÝÖÁ2014Äê¡£¡£¡£¸ÃÊý¾Ý¿âÔÚδÉèÃÜÂëµÄÇéÐÎÏÂÅþÁ¬µ½»¥ÁªÍø£¬£¬£¬£¬£¬²¢ÔÚÍøÂçÉÏ̻¶ÁËÁè¼Ý3ÖܵÄʱ¼ä¡£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://www.zdnet.com/article/indian-govt-agency-left-details-of-millions-of-pregnant-women-exposed-online/

5¡£¡£¡£GoogleÐû²¼4ÔÂAndroidÇå¾²¸üУ¬£¬£¬£¬£¬ÐÞ¸´¶à¸öÎó²î

¿­·¢¡¤k8(ÖйúÓÎ)¹Ù·½ÍøÕ¾


GoogleÐû²¼4ÔÂAndroidÇå¾²¸üУ¬£¬£¬£¬£¬ÔÚÇå¾²²¹¶¡¼¶±ð2019-04-01ÖУ¬£¬£¬£¬£¬GoogleÐÞ¸´ÁËÁ½¸ö¸ßΣRCEÎó²îºÍ9¸öÌáȨ£¨EoP£©¼°ÐÅϢй¶£¨ID£©Îó²î¡£¡£¡£ÕâÁ½¸öRCEÎó²îÊÇýÌå¿ò¼Ü×é¼þÖеÄÎó²î£¨CVE-2019-2027ºÍCVE-2019-2028£©£¬£¬£¬£¬£¬¿Éµ¼ÖÂí§Òâ´úÂëÖ´ÐУ¬£¬£¬£¬£¬Android 7.0¼°Ö®ºóµÄ°æ±¾¶¼ÊÜÓ°Ïì¡£¡£¡£ÁíÒ»¸öÇå¾²²¹¶¡¼¶±ðÊÇ2019-04-05£¬£¬£¬£¬£¬½¨ÒéÓû§¾¡¿ì×°ÖÃÕâЩ¸üС£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://www.bleepingcomputer.com/news/security/google-fixes-two-critical-android-code-execution-vulnerabilities/

6.ApacheÐû²¼Ð°汾2.4.39£¬£¬£¬£¬£¬ÐÞ¸´¶à¸öÎó²î


¿­·¢¡¤k8(ÖйúÓÎ)¹Ù·½ÍøÕ¾


Apache HTTP Server 2.4.39ÖÐÐÞ¸´Á˶à¸öÇå¾²Îó²î£¬£¬£¬£¬£¬×îΪÑÏÖØµÄÎó²îÊÇÌáȨÎó²î£¨CVE-2019-0211£©£¬£¬£¬£¬£¬¸ÃÎó²îÓ°ÏìÁË2.4.17µ½2.4.38Ö®¼äµÄËùÓа汾£¬£¬£¬£¬£¬ÔÊÐí¾ßÓо籾дÈëºÍÔËÐÐȨÏÞµÄÓû§»ñµÃrootȨÏÞ²¢Ö´ÐÐí§Òâ´úÂë¡£¡£¡£±ðµÄ£¬£¬£¬£¬£¬¸Ã°æ±¾»¹ÐÞ¸´ÁË»á¼û¿ØÖÆÈƹýÎó²î£¨CVE-2019-0217ºÍCVE-2019-0215£©¡¢¿ÉÄܵ¼ÖÂÍß½âµÄÎó²î£¨CVE-2019-0197£©¡¢read-after-freeÎó²î£¨CVE-2019-0196£©ºÍURL¹æ·¶»¯·×ÆçÖÂÎó²î£¨CVE-2019-0220£©¡£¡£¡£


Ô­ÎÄÁ´½Ó£º

https://www.bleepingcomputer.com/news/security/apache-bug-lets-normal-users-gain-root-access-via-scripts/