Comments
Meltdown, Spectre Likely Just Scratch the Surface of Microprocessor Vulnerabilities
Newest First  |  Oldest First  |  Threaded View
BrianN060
50%
50%
BrianN060,
User Rank: Ninja
1/10/2018 | 6:03:57 PM
Still just vulnerabilities
As bad as these out-of-sequence execution vulnerabilities are (and might prove to be), we saw more than enough monsterously bad cybersecurity breaches in 2017 - without the help of Meltdown, Spectre or any follow-on scenarios. 

We need something better than just chasing down vulnerabilities and patching, to approach any acceptable level of cybersecurity.  
PatrickH94102
50%
50%
PatrickH94102,
User Rank: Apprentice
1/9/2018 | 8:09:34 PM
Re: Another thing to consider
Yup BIOS updates have been a mostly ignored / de-prioritized security risk.  Some new security companies such as Eclypsium are working on BIOS integrity and version reporting & updating for enterprises.
REISEN1955
100%
0%
REISEN1955,
User Rank: Ninja
1/9/2018 | 1:09:33 PM
Re: Another thing to consider
Fortunately most BIOS updates are now operating system - installable items.  I remember the dead, long dead days of Compaq Deskpro with 3.5" floppy disk updates and heaven forbid you interrupt the BIOS load --- dead machine if you do that.  
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
1/9/2018 | 10:49:36 AM
Re: Another thing to consider
Firmware updates are going to become a much bigger issue for IT and security folks now for more than just IoT devices. And servers obviously are a priority, so it's going to be interesting.
REISEN1955
50%
50%
REISEN1955,
User Rank: Ninja
1/9/2018 | 10:45:24 AM
Another thing to consider
BIOS - How many IT professionals regularly update the BIOS of their office systems?  My estimate is easy: never and knowing the threat landscape, there HAS to be vulnerabilities there as well. 


More Than Half of Users Reuse Passwords
Curtis Franklin Jr., Senior Editor at Dark Reading,  5/24/2018
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11506
PUBLISHED: 2018-05-28
The sr_do_ioctl function in drivers/scsi/sr_ioctl.c in the Linux kernel through 4.16.12 allows local users to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact because sense buffers have different sizes at the CDROM layer and the SCSI layer.
CVE-2018-11507
PUBLISHED: 2018-05-28
An issue was discovered in Free Lossless Image Format (FLIF) 0.3. An attacker can trigger a long loop in image_load_pnm in image/image-pnm.cpp.
CVE-2018-11505
PUBLISHED: 2018-05-26
The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output.
CVE-2018-6409
PUBLISHED: 2018-05-26
An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of the file to serve on the corresponding ap_form table leads to a path traversal vulnerability via the download.php q parameter.
CVE-2018-6410
PUBLISHED: 2018-05-26
An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.