2019년 12월 5일 보안정보 입니다.

12월 5일 보안정보 입니다.

=================================================

+ 주요 취약점 - Mozilla, Firefox 및 Firefox ESR에 대한 보안 업데이트 발표 외 1건

1. Mozilla, Firefox 및 Firefox ESR에 대한 보안 업데이트 발표
[요약]
Firefox 71 및 Firefox ESR 68.3 보안 업데이트 권고
- https://www.us-cert.gov/ncas/current-activity/2019/12/04/mozilla-releases-security-updates-firefox-and-firefox-esr

2. WordPress CSS Hero 4.0.3 Cross Site Scripting
[요약]
크로스 사이트 스크립팅
- https://packetstormsecurity.com/files/155558/WordPress-CSS-Hero-4.0.3-Cross-Site-Scripting.html

=================================================

+ 취약점 - Microsoft 제품 취약점 외 2건

1. Microsoft 제품 취약점
Microsoft Windows Media Center XML Injection
- https://packetstormsecurity.com/files/155553/Microsoft-Windows-Media-Center-XML-Injection.html

Microsoft Visual Basic 2010 Express XML Injection
- https://packetstormsecurity.com/files/155555/Microsoft-Visual-Basic-2010-Express-XML-Injection.html

Microsoft Windows BasicRender.sys WARPGPUCMDSYNC NULL Pointer
- https://packetstormsecurity.com/files/155551/Microsoft-Windows-BasicRender.sys-WARPGPUCMDSYNC-NULL-Pointer.html

2. YouPHPTube 7.7 SQL Injection
[요약] 
SQL 인젝션
- https://packetstormsecurity.com/files/155564/YouPHPTube-7.7-SQL-Injection.html

3. Linux Kernel USB driver 취약점
Linux Kernel USB driver information disclosure (CVE-2019-19536)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172532

Linux Kernel USB driver information disclosure (CVE-2019-19535)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172531

Linux Kernel USB driver information disclosure (CVE-2019-19534)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172530

Linux Kernel USB driver information disclosure (CVE-2019-19533)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172529

Linux kernel USB driver use-after-free denial of service (CVE-2019-19531)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172528

Linux kernel USB driver use-after-free denial of service (CVE-2019-19530)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172527

Linux kernel USB driver use-after-free denial of service (CVE-2019-19529)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172526

Linux kernel USB driver use-after-free denial of service (CVE-2019-19528)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172525

Linux kernel USB driver use-after-free denial of service (CVE-2019-19527)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172524

Linux kernel USB driver use-after-free denial of service (CVE-2019-19526)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172523

Linux kernel USB driver use-after-free denial of service (CVE-2019-19525)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172522

Linux kernel USB driver use-after-free denial of service (CVE-2019-19524)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172521

Linux kernel USB driver use-after-free denial of service (CVE-2019-19523)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/172520

=================================================

+ 보안정보 - 중국의 인기 높은 영상 앱 틱톡, 집단소송에 걸리다 외 2건

1. 중국의 인기 높은 영상 앱 틱톡, 집단소송에 걸리다
[요약]
인스타그램도 이길 정도로 인기 높은 영상 플랫폼 틱톡.
캘리포니아의 한 학생, “틱톡이 내 정보를 중국 서버로 몰래 옮겼다”고 주장하며 집단소송 시작.
틱톡은 중국 업체라 중국 국내법 상 중국 정부에 협조할 수밖에 없음.
- https://www.boannews.com/media/view.asp?idx=84977

2. 침투 테스트용 OS 칼리 리눅스, 새 기능 탑재한 버전 나와
[요약]
오펜시브 시큐리티, 새로운 칼리 리눅스 발표.
칼리 리눅스는 침투 테스트(모의 해킹)에 주로 사용되는 OS.
더 가벼워지고 빨라졌으며, ‘언더커버’라는 새로운 보안 기능 추가됨.
- https://www.boannews.com/media/view.asp?idx=84975

3. 홍콩 반정부 시위자 대상으로 대규모 스피어 피싱 공격 있었다
[요약]
NSHC, 홍콩 시위 참가자 대상 스피어 피싱 공격 분석 보고서 발표
홍콩 시위에 참여했던 참가자를 대상으로 발송된 스피어 피싱 이메일이 발견
운영 체제 버전 및 아키텍처, 컴퓨터 이름, 로그인 한 사용자, 날짜 정보를 포함하는 암호화된 파일을 생성하고 C2 서버로 전송
- https://www.boannews.com/media/view.asp?idx=84945

=================================================