ICT for Myanmar in English

A Directory Traversal Vulnerability was identified in Oracle Enterprise Manager Application Testing Suite. The vulnerability can be exploited over the HTTP protocol. A remote, unauthenticated attacker can exploit this vulnerability to download arbitrary files from the target server. This vulnerability affects the following supported versions: - Oracle Application Testing Suite 12.4.0.2 - Oracle Application Testing Suite 12.5.0.2 The vulnerability has been patched by the vendor, please find the details here . (http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html) This vulnerability is referred by CVE as CVE-2016-0484. It is time to patch you Security Device to prevent this. Have a good time. (Be knowledgeable, pass it on then)

Remote Authentication Dial In User Service (RADIUS), a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA) services to connect network resources. Attacker can use crafted username which could lead to Denial of Service. To Authenticate and Authorize users, RADIUS server connects to Domain controller. Active Directory is queried for username upon incoming access request message. This involves establishing LDAP connection and passing LDAP query. LDAP filter tests the username for predefined special characters and normalize them except NUL character. If username string starts with NUL character it causes Active Directory Domain Controller server to return an error value. Multiple invalid requests cause RADIUS server to disassociated from Active Directory Domain controller. Causing Denial of further requests. So if you aware on this and haven't patch you IPS signature yet? Please update it quickly to prevent your network. ...

The Dell SonicWALL Threats Research team has received a sample of a backdoor Trojan posing as a game hack. Cheats for games often contain malware and that might not come as a surprise to many. But as a game becomes more popular, cybercriminals take advantage of eager gamers with a promise to help unlock abilities or perhaps accumulate enough credits to buy something to progress in a game and these shortcuts make them more appealing. The sample we received is posing as a cheat to a top ranking free sports game. In fact, searching for 8 Ball Pool game online yields keywords suggestions such as "hack" and "cheats." Infection Cycle The Trojan arrives as a file named "hack 8 ball pool.exe." Upon execution, it copies itself to the following directory: %TEMP%\chrome.exe In order to start after reboot the Trojan adds the following keys to the registry: HKLM\software\microsoft\windows\currentversion\run[8ce73491bf190a3fd7028c92bd3331b1]...

SonicWall's Application Control block some required Application for WeChat Application. So that Mobile Device users using WeChat will not be able to Sign Up in you network and they will get "Connection error. Check your network settings." For those who already has account also will not able to sign in by using QR code. Laptop/Desktop WeChat user also will encounter the error as below. To solve these issue, you need to Unblock/Allow the Applications from below Application Signature List in your SonicWall. Application Category : Proxy-Access (27) Application : Proxy-Access HTTP (966) Application Signature : Proxy-Access HTTP Proxy -- HTTP Proxy POST (9685) You still need to Allow/Exclude below IP Address lists from Application Control List of your SonicWall.(In fact, WeChat used many IP Addresses and need to check logs and add some more if your issue not resolve yet by adding below list.) 203.205.129.101 203.205.147.168 203.205.151.160 140.206.1...

As usual, online shopping website are discounting for year ends after ThanksGiving Day, Black Friday and Cyber Monday. As a result, spammer also launch spam campaign to find the victim via online shopping. Below are guide for "How to stay safe" at online and "Best practices for avoiding email scams". How to Stay Safe An important skill to stay safe online is how to identify fraudulent domain names used in malicious links in emails. Scammers will usually try to deceive end users by disguising the true second-level domain, by prepending legitimate, familiar names to the beginning of hostnames. Appearing to come from a legitimate sources, the malicious email will contain links to sites that host exploit code with the hope that the user have unpatched systems and vulnerable web browsers, and the goal of compromising the user's system. Other attack vectors come directly in email attachments--word docs, executables, and other infected files. Best practices for avoid...

Remote code execution vulnerability exists in Microsoft Office software and is caused when the Office improperly handles objects in memory while parsing specially crafted Office files. This could corrupt system memory in such a way as to allow an attacker to execute arbitrary code CVE-2015-0097 .   To exploit this vulnerability the user has to be tricked into visiting the attacker's website by clicking on a link. Another scenario could be downloading and opening specially crafted MS office email attachment. Microsoft Word, Excel and Powerpoint contains a remote code execution vulnerability because it is possible to reference documents such as Works document (.wps) as HTML. It will process HTML and script code in the context of the local machine zone of Internet Explorer which leads to arbitrary code execution.  Once the user opens the office document the attacker is able to perform actions in security context of the logged in user.  When the user ope...

NTP is a protocol designed to synchronize the clocks of computers over a network. The NTP Project produces a reference implementation of the NTP protocol and implementation documentation through a largely volunteer effort. NTP uses a hierarchical, semi-layered system of time sources. Each level of this hierarchy is termed a "stratum" and is assigned a number starting with zero at the top. The NTP Project conducts Research and Development in NTP and produces the Official Reference Implementation of NTP along with the Implementation Documentation. A few weeks ago, ntp-4.2.8p4 was released which fixed multiple vulnerabilities. "NTP Daemon Arbitrary File Overwrite" , which addresses CVE-2015-7703 Description: If ntpd is configured to allow for remote configuration, and if the (possibly spoofed) source IP address is allowed to send remote configuration requests, and if the attacker knows the remote configuration password, it's possible for an att...