2020년 1월 9일 보안정보 입니다.

1월 9일 보안정보 입니다.

=================================================

+ 주요 취약점 - Google Releases Security Updates for Chrome 외 1건

1. Google Releases Security Updates for Chrome
Google has released security updates for Chrome version 79.0.3945.117 for Windows, Mac, and Linux
- https://chromereleases.googleblog.com/2020/01/stable-channel-update-for-desktop.html

2. Mozilla Releases Security Updates for Firefox and Firefox ESR
Mozilla has released security updates to address vulnerabilities in Firefox and Firefox ESR
- https://www.us-cert.gov/ncas/current-activity/2020/01/08/mozilla-releases-security-updates-firefox-and-firefox-esr

=================================================

+ 취약점 - Tomcat 9.0.0.M1 Sandbox Escape 외 2건

1. Tomcat 9.0.0.M1 Sandbox Escape
Tomcat version 9.0.0.M1 proprietaryEvaluate sandbox escape proof of concept.
- https://packetstormsecurity.com/files/155873/Tomcat-9.0.0.M1-Sandbox-Escape.html

2. Sony Playstation 4 Webkit Code Execution
Sony Playstation 4 (PS4) versions prior to 6.72 webkit code execution proof of concept exploit.
- https://packetstormsecurity.com/files/155871/Sony-Playstation-4-Webkit-Code-Execution.html

3. Cisco DCNM JBoss 10.4 Credential Leakage
Cisco DCNM JBoss version 10.4 suffers from a credential leakage vulnerability.
- https://packetstormsecurity.com/files/155870/Cisco-DCNM-JBoss-10.4-Credential-Leakage.html

=================================================

+ 보안정보 - 인기 SNS 틱톡에서 영상 콘텐츠 조작 가능케 하는 취약점 발견돼 외 2건

1. 인기 SNS 틱톡에서 영상 콘텐츠 조작 가능케 하는 취약점 발견돼
중국의 인기 SNS 앱 틱톡에서 다수 취약점 발견됨.
이 취약점 통해 사용자 콘텐츠 조작은 물론 개인정보 열람도 가능.
틱톡 개발사는 2~3주 만에 패치 개발해 배포하기 시작함.
- https://www.boannews.com/media/view.asp?idx=85664

2. 미국의 국토안보부, 이란의 해킹 공격 조심하라고 공식 경고
미국의 국토안보부, 이란 해킹 공격 경고하는 첫 번째 공식 문서 발표.
이란의 APT 그룹들이 잘 노리는 산업과, 잘 사용하는 도구들도 함께 공개.
미국만이 아니라 미국의 동맹국들도 위험할 수 있으니 조심.
- https://www.boannews.com/media/view.asp?idx=85640

3. 기업 네트워크를 노리는 SNAKE 랜섬웨어 발견
기업 네트워크를 공격하여 연결된 모든 기기를 암호화하려 시도하는 새로운 랜섬웨어인 SNAKE가 발견
- https://www.bleepingcomputer.com/news/security/snake-ransomware-is-the-next-threat-targeting-business-networks/

=================================================