2020년 2월 18일 보안정보 스크래핑

2월 18일 보안정보 스크래핑 

==================================================================== 

+ 주요 취약점 - 브레인즈스퀘어 Zenius v6.1 보안 업데이트 권고

1. 브레인즈스퀘어社의 Zenius 보안 업데이트 권고
**(Zenius : IT 인프라(서버, NW, DB 등) 통합 관리 시스템)
영향 받는 버전을 사용 중인 이용자는 해결 방안을 참고하여 보안 업데이트 권고
- https://www.krcert.or.kr/data/secNoticeView.do?bulletin_writing_sequence=35272

==================================================================== 

+ 취약점 - Microsoft Windows 취약점 외 1건

 1. Microsoft Windows 취약점
Microsoft Windows Modules Installer Service Information Disclosure
Exploit Type: Information Disclosure 
- https://packetstormsecurity.com/files/156394/Microsoft-Windows-Modules-Installer-Service-Information-Disclosure.html

Microsoft Windows 10 MSI Privilege Escalation
Exploit Type: privilege escalation vulnerability
- https://packetstormsecurity.com/files/156373/Microsoft-Windows-10-MSI-Privilege-Escalation.html

 2. WordPress 취약점
WordPress Fruitful 3.8 Cross Site Scripting
Exploit Type: XSS
- https://packetstormsecurity.com/files/156390/WordPress-Fruitful-3.8-Cross-Site-Scripting.html

WordPress Strong Testimonials 2.40.1 Cross Site Scripting
**(Strong Testimonials은 회원 평가 또는 리뷰를 수집하고 게시하는 WordPress 플러그인)
Exploit Type: XSS
- https://packetstormsecurity.com/files/156369/WordPress-Strong-Testimonials-2.40.1-Cross-Site-Scripting.html

==================================================================== 

+ 보안이슈 - 주요 사물인터넷 SoC 칩셋에서 블루투스 취약점 12개 넘게 나와 외 2건 

 1. 주요 사물인터넷 SoC 칩셋에서 블루투스 취약점 12개 넘게 나와
블루투스 연결 기술 중 하나인 BLE의 구현용 소프트웨어 개발 키트에서 취약점 다수 나옴.
현재까지 공개되고 패치된 건 12개. 더 있지만 안전 위해 아직 공개되지 않음.
이 취약점들을 하나로 묶어 스웨인투스라고 부르는데, 2018~2019년 출시된 IoT 장비들에서 주로 나타남.
출처: 보안뉴스 (https://www.boannews.com/media/view.asp?idx=86424)

 2. 이란의 해킹 단체 APT33과 APT34, 협업하며 VPN 뚫어
이란의 해킹 그룹 APT33과 APT34, 2017년부터 협업해온 듯.
인프라와 도구를 공유하면서 공격 비용 낮추고 성공률은 높임.
특히 기업들이 사용하는 VPN 제품들에서 발견된 취약점을 집중적으로 익스플로잇.
출처: 보안뉴스 (https://www.boannews.com/media/view.asp?idx=86445)

 3. 미국 사이버 사령부, 라자루스의 멀웨어 샘플 6개 공개
2018년 말부터 멀웨어 샘플을 민간 부문과 공유하는 미국 사이버 사령부.
최근 북한 라자루스의 무기로 보이는 멀웨어 샘플 6개를 바이러스토탈에 업로드.
CISA는 여기에 맞춰 각 멀웨어에 대한 분석 보고서를 함께 발표.
출처: 보안뉴스 (https://www.boannews.com/media/view.asp?idx=86444)

====================================================================