2020년 4월 16일 보안정보 스크래핑

2020년 4월 16일 보안정보 스크래핑 

==================================================================== 

+ 주요 취약점 - Adobe, 여러 제품에 대한 보안 업데이트 발표 외 4건

 1. Adobe, 여러 제품에 대한 보안 업데이트 발표
침입자는 이러한 취약점 중 일부를 악용하여 영향을받는 시스템을 제어 할 수 있음
- https://www.us-cert.gov/ncas/current-activity/2020/04/14/adobe-releases-security-updates-multiple-products

 2. Microsoft, 2020 년 4 월 보안 업데이트
원격 공격자는 이러한 취약점 중 일부를 악용하여 영향을받는 시스템을 제어 할 수 있음
- https://www.us-cert.gov/ncas/current-activity/2020/04/14/microsoft-releases-april-2020-security-updates

 3. Intel, 보안 업데이트 발표
침입자는 이러한 취약점 중 일부를 악용하여 권한을 상승시킬 수 있음
- https://www.us-cert.gov/ncas/current-activity/2020/04/14/intel-releases-security-updates

 4. VMware, vRealize Log Insight에 대한 보안 업데이트 발표
침입자는 이 취약점을 악용하여 영향을받는 시스템을 제어 할 수 있음
- https://www.us-cert.gov/ncas/current-activity/2020/04/14/vmware-releases-security-updates-vrealize-log-insight

 5. Oracle, 2020 년 4 월 보안 공지
원격 공격자는 이러한 취약점 중 일부를 악용하여 영향을받는 시스템을 제어 할 수 있음
- https://www.us-cert.gov/ncas/current-activity/2020/04/15/oracle-releases-april-2020-security-bulletin

==================================================================== 

+ 취약점 - Google Chrome speech recognizer code execution (CVE-2020-6457)

 1. Google Chrome speech recognizer code execution (CVE-2020-6457)
vulnerability type : Gain Access
- https://exchange.xforce.ibmcloud.com/vulnerabilities/179626

==================================================================== 

+ 보안이슈 - WebSphere Application Server 권한 에스컬레이션 취약점 경고 외 2건

 1. WebSphere Application Server 권한 에스컬레이션 취약점 경고
CVE-2020-4276, CVE-2020-4362는 IBM WebSphere Application Server의 권한 에스컬레이션 취약점
원격 공격자가 권한 상승을 수행 한 다음 대상 서버에서 임의의 악성 코드를 실행하여 시스템 권한을 얻을 수 있음
WebSphere Application Server 보안패치 필요
출처: Infotech news https://meterpreter.org/cve-2020-4276-cve-2020-4362-websphere-application-server-privilege-escalation-vulnerability-alert/

 2. ‘저금리로 대출해 준다’는 카카오톡 문자? 알고 보니 스미싱 공격
이스트시큐리티, ‘저금리 대출 문자’ 사칭 신종 카카오톡 스미싱 공격 주의 당부
출처: 보안뉴스 https://www.boannews.com/media/view.asp?idx=87605

 3. 클라우드 환경에서 가장 큰 위험 요인? 바로 ‘설정 오류’
트렌드마이크로, 클라우드 보안 위협 보고서 발표
클라우드 마이그레이션의 모든 과정에서 사이버보안의 필요성 강조
출처: 보안뉴스 https://www.boannews.com/media/view.asp?idx=87602

====================================================================