Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Critical Microprocessor Flaws Affect Nearly Every Machine
Newest First  |  Oldest First  |  Threaded View
MelBrandle
MelBrandle,
User Rank: Moderator
7/18/2018 | 10:13:28 PM
Re: Simple Solution
This is highly worrying but somehow rather expected too. As long as you are connected to the internet, your device remains in a vulnerable state. You can install preventive softwares but they can only do so much. Let's just hope the sensitive data that you have remains safe with the latest upgrades that you need to regularly update to avoid becoming an easy target.
REISEN1955
REISEN1955,
User Rank: Ninja
1/5/2018 | 8:33:12 AM
Simple Solution
I read this morning that there is a simple solution here and it is so in theory.  REPLACE EVERYTHING.  With what i do not know but JUST REPLACE EVERY COMPUTER EVERYWHERE.  Remember too we are talking servers, data center machines, peripherals --- just replace.  Consider the impact!!!!!!   And if you accept this premise --- replace with, eh ---- WHAT precisely?????  No new technologies that I have heard of discussed so far.  Just PATCH PATCH AND PATCH and be careful out there. 
REISEN1955
REISEN1955,
User Rank: Ninja
1/4/2018 | 2:26:09 PM
Re: Something missing from article
Agree - and many patches are due to be released by damn near everybody so I can see a trend that any software that accesses the processor (define now - everything) can be a source of penetration.  What really disturbs me (my 8088 rants aside) is that it has taken YEARS for somebody to notice this one.  We now have decade or longer vulnerability ranges which is terrifying.  
RalphDaly28
RalphDaly28,
User Rank: Apprentice
1/4/2018 | 1:03:18 PM
Something missing from article
What I havent' seen explictly in the articles I have read about this is the nature of the programs that can execute this attack. For instance, can viewing a web page execute the attack? Or does it require that an actual EXE be executed on the machine? The reports I have seen so far imply that it an attack would require a program to execute on an affected machine. But it is implied only.
REISEN1955
REISEN1955,
User Rank: Ninja
1/4/2018 | 10:57:12 AM
Re: Something to be said for the 8088
Asking alot of this community, but there was some really fun stuff for that ancient sys.  KINGDOM OF KROZ and variants were wonderful games.  The screen MENU programs were delightful in simplicity and I sitll enjoyed old Word Perfect 4.2 as well.  How many of us cut our teeth on LOTUS 1-2-3.  You could do great stuff on these old platforms. 
REISEN1955
REISEN1955,
User Rank: Ninja
1/4/2018 | 10:38:31 AM
Something to be said for the 8088
I am sorry to an extent that I no longer own my trusty clone IBM XT system, that 8088 was indeed secure and back in 1985 malware written for DOS 6.22 was indeed rare.  Internet barely exists and I used Compuserve (EasyPlex email) to communicate with the outside world.  Inter-system connect was through PROCOMM (ah, there was a good product).   Times change and not necessarily for the better. 


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Building the SOC of the Future
While an attacker just needs to find one vulnerability to get in to the network, the defender has to look everywhere. Defenders have to identify, disrupt, and stop attacks in the short period of time between when an attacker gets in and causes damage. One way is a security operations center to get that "all the time" coverage. What's Inside: --AI and cybersecurity response --Automation --Proctive threat hunting --Next-gen SIEM
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2022-42074
PUBLISHED: 2022-10-07
Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=.
CVE-2022-42075
PUBLISHED: 2022-10-07
Wedding Planner v1.0 is vulnerable to has arbitrary code execution.
CVE-2022-37895
PUBLISHED: 2022-10-07
An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitation of this vulnerability results in the ability to interrupt the normal operation of the affected AP of Aruba InstantOS 6.4.x: 6.4.4.8-4.2.4...
CVE-2022-37896
PUBLISHED: 2022-10-07
A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS) attack against a user of the interface. A successful exploit could allow an attacker to execute arbitrary script code in a victimâ&euro...
CVE-2022-41377
PUBLISHED: 2022-10-07
Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=maintenance/manage_category.