BadLock漏洞技术跟踪与风险防护

绿盟科技持续关注国内安全走势,早在3月份的时候第一时间发布了BadLock威胁预警通告。4月12日,微软补丁日如期而至。在这次微软发布的补丁中,包含了BadLock漏洞,该漏洞可对windows系统和Samba服务一律全版本通杀,危害程度不可小觑。对此,绿盟科技针对BadLock漏洞进行了技术跟踪分析并提供相应的防护建议。

BadLock威胁预警通告

发布时间:2016年3月28日

2016年4月12日,关于 Microsoft Windows平台和Samba服务软件中存在的一个严重等级的安全漏洞将会被披露,定名为BadLock。 此漏洞由International Samba Core Team成员Stefan Metzmacher发现,并提交给Microsoft和Samba相关的部门。
目前,Microsoft和Samba的工程师们正在合作修复问题,补丁将会于2016年4月12日发布。

An Analysis of the Ukraine Power Plant Attack Event and Countermeasures Against It

In December 2015, a power outage occurred in Ukraine as a result of a cyberattack, causing a great panic. This document analyzes and verifies the attack event-related information and core samples, and provides a solution accordingly.

An Analysis of the vBulletin 5.x Remote Code Execution Exploit

vBulletin is a commercial Internet forum software package, boasting tens of thousands of users which are growing rapidly worldwide. It is written in the PHP web language and uses the MySQL database. Owing to its large user base, vBulletin is frequently reported to have vulnerabilities. In NSFOCUS Vulnerability Database (NSVD), there are 49 entries related to vBulletin, most of which are SQL injection vulnerabilities. The vulnerability disclosed this time is of a relatively high risk level, known as remote code execution (RCE). Theoretically, an attacker can exploit this vulnerability to execute arbitrary code or even take complete control of a forum that uses this program.