kaito834のブックマーク - はてなブックマーク

CERT/CC Vulnerability Note VU#357851

Some Internet router devices incorrectly accept UPnP requests over the WAN interface. Universal Plug and Play (UPnP) is a networking protocol mostly used for personal computing devices to discover and communicate with each other and the Internet. Some UPnP enabled router devices incorrectly accept UPnP requests over the WAN interface. "AddPortMapping" and "DeletePortMapping" actions are accepted o

kaito834 2012/02/22

2011年8月、WAN側インターフェイスがUPnPリクエスト（？）を受け付けるルータが複数存在することが公表された。CVEで「UPnP WAN」で検索すると、該当するCVE番号を確認できる。例えば、CVE-2011-4499。

リンク

CERT/CC Vulnerability Note VU#763355

Vulnerability Note VU#763355 Original Release Date: 2012-02-01 | Last Revised: 2012-02-01 A user's 802.1X WiFi credentials and SSID information may be exposed to any application with basic WiFi permissions on certain HTC builds of Android. Any Android application on an affected HTC build with the android.permission.ACCESS_WIFI_STATE permission can use the .toString() member of the WifiConfiguratio

kaito834 2012/02/02

2012年2年、HTCのAndroid端末にて android.permission.ACCESS_WIFI_STATEパーミッションを付与したアプリが WifiConfiguration クラス経由で802.1Xの認証情報などを閲覧できてしまう問題が発覚した。

リンク

CERT/CC Vulnerability Note VU#864643

A vulnerability in the specification of the SSL 3.0 and TLS 1.0 protocols could allow an attacker to decrypt encrypted traffic. The Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols are commonly used to provide authentication, encryption, integrity, and non-repudiation services to network application protocols such as HTTP, IMAP, POP3, LDAP, SMTP, and others. Several differen