Mutagen Astronomy: A new integer overflow vulnerability affect linux kernel

Mutagen Astronomy vulnerability tracked as CVE-2018-14634, is a type of a local privilege escalation issue Discoverd by Qualys —and exists in the Linux kernel's create_elf_tables() function that operates the memory tables.
IMPACT :
To successfully exploit this vulnerability, attackers need to have access to the targeted system and run their exploit that leads to a buffer overflow, thereby resulting in the execution of malicious code and achieving complete control of the affected system.

Affected Systems:

1. This security vulnerability can be exploited to escalate privileges to root via a SUID-root binary, but it only works on 64-bit systems.

2. Affects the kernel versions released between July 2007 and July 2017, impacting the Red Hat Enterprise Linux, CentOS, and Debian distributions.

Exploit:
Qualys researchers have also released both technical details and proof-of-concept (PoC) exploits (Exploit 1, Exploit 2) for the vulnerability to the public.

Zero Day Alert ! Microsoft Windows JET Database engine vulnerability

ZDI  Has released details for unpatched zero day vulnerability in the Microsoft Windows JET Database engine vulnerability which affects all windows versions

Root Cause:
The root cause of this issue resides in the Microsoft JET Database Engine. Microsoft patched two other issues in JET in the September Patch Tuesday updates. While the patched bugs are listed as buffer overflows, this additional bug is actually an out-of-bounds write, which can be triggered by opening a Jet data source via OLEDB.

How To Exploit:To trigger this vulnerability, a user would need to open a specially crafted file containing data stored in the JET database format. Various applications use this database format. An attacker using this would be able to execute code at the level of the current process.

POC:
Here is the link of github that contains the POC

How to protect:
1. Use updated security software restrict
2. Do not open files from untrusted source

Gone in 2 Seconds : Tesla Model S Hack

KU Leuven researchers found that Tesla uses a keyless entry system built by a manufacturer called Pektron, which uses a weak 40-bit cipher to encrypt those key fob codes.

The researchers made a 6-terabyte table of all possible keys for any combination of code pairs, and then used a Yard Stick One radio, a Proxmark radio, and a Raspberry Pi mini-computer, which cost about $600 total—not bad for a Tesla Model S though—to capture the required two codes.

With that table and those two codes, the team says it can calculate the correct cryptographic key to spoof any key fob in just 1.6 seconds. To understand more clearly, you can watch the proof of concept video demonstration which shows the hack in action.

The team reported the issue to Tesla last year, but the company addressed it in June 2018 by upgrading the weak encryption. Last month, the company also added an optional PIN as an additional defense.

Tesla Paid $10,000 Bounty to the Researchers

After the story broke, Tesla was criticised on Twitter for using a weak cipher, though a member of the KU Leuven team appreciated Tesla for quickly responding to their report and fixing the issue,, on the same time, accused other vehicle makers using keyless entry techhashtag

Google Fixes 40 Security bugs in new Chrome Updates for Windows, Mac, Linux, Android

A new version of Google Chrome is rolling out to Windows, Mac, Linux, and Android over the next few weeks, the company announced this week.

Chrome version 69.0.3497.81 is being promoted to the stable channel for Windows, Mac, and Linux. The update packs 40 security fixes, including patches for vulnerabilities an attacker could abuse to assume control over a target system, according to a US-CERT advisory on the update.

In addition to Google's security team, many of the bugs were detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Chrome for Android 69 (69.0.3497.76) has also been released and will be available on Google Play over the next few weeks, Google reports. The 10^thanniversary edition aims to improve mobile payment security with third-party payment apps, password generation on more websites, stability and performance improvements, and a cleaner modernized design.

Read more details here.