logo-monin
+32 (0)3 450 67 89
info@monin-it.be

Category: Security

Zombieload, RIDL & Fallout and Store-to-Leak Forwarding vulnerabilities for Oracle Linux, Oracle VM and Microsoft Windows (collectively referred to as Microarchitectural Data Sampling (mds))

Dries

Again 4 new execution side-channel vulnerabilities were disclosed by Intel on May 14th. Each of them has its own name but collectively they are referred as Microarchitectural Data Sampling (mds): CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM): part of RIDL CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS): part of Fallout CVE-2018-12127: Microarchitectural Load Port Data…

Do you suddenly need a payed subscription for using (Oracle) Java?

Dries

Last update: September 6th 2019 IMPORTANT: information provided is purely informative and has no legal value Update September 2nd 2019: inform your JAVA users they should not just install the latest update, which can easily be done by pressing “Install” or “Next” after following window appears It shows the user a separate license is needed…

How-to make yourself a SYSADMIN “very easily” on Microsoft SQL Server (exploit)

Dries

Within Microsoft SQL Server databases, some fixed server-level roles are defined, providing a certain level of access and functionality. The role with the highest access and functionality is the SYSADMIN role. Only privileged users or administrators within the company are granted this role. Eddy Van Heghe, one of our experienced Microsoft SQL DBA’s, discovered a…

L1TF Intel Processor vulnerabilities for Oracle Linux, Oracle VM and Microsoft Windows (Foreshadow)

Dries

After the Spectre & Meltdown vulnerabilities (see https://monin-it.be/2018/01/17/meltdown-spectre-solution-linux-windows/) at the beginning of 2018, Intel now tackled 3 applications of another big vulnerability in their microcode: the L1 Terminal Fault (L1TF) vulnerabilities. All three applications of L1TF are speculative execution side channel cache timing vulnerabilities: CVE-2018-3615: Affecting Intel Software Guard Extensions (SGX): CVSS score 7.9/10 CVE-2018-3620:…

Urgently patch your Oracle database or get held hostage (CVE-2018-3110)!

Dries

Oracle just released a security alert and is urging users to patch their oracle database installations to plug a critical security issue (this one even got CVSS score 9.9/10, which is really high and shows the importance to patch). The vulnerability can result in complete compromise of the Oracle Database and shell access to the…