Aggregator

error code: 521

在即将过去的2024年，亚太地区的网络犯罪分子越来越多地利用人工智能（AI）发起复杂的攻击活动，例如 AI 生成的钓鱼邮件、自适应恶意软件和深度伪造。 Check Point 软件技术公司亚太区安全架构师和布道师 Clement Lee 表示，这些攻击削弱了对关键通信的信任，并加剧了社会紧张局势。 他例举了一些具体案列：在印度，深度伪造助长了广泛的不实信息传播；在印度尼西亚，一段经过篡改的深度伪造视频旨在煽动反华情绪；在中国香港，一名财务员工因深度伪造冒充公司高管而被骗转账 2500 万美元。 对于即将到来的2025年，Palo Alto Networks 亚太及日本区总裁 Simon Green 认为亚太地区将迎来“AI 驱动的网络威胁”。他指出，深度伪造音频和视频攻击可能是这一趋势中最明显的表现形式。 随着亚太地区越来越多的企业组织在实施 AI 项目，预计会更多地寻求更好保护其数据的方法。 AvePoint 澳大利亚和新西兰副总裁兼董事总经理 Max McNamara 表示，客户正在询问如何在保持强大安全性的同时，从数据中获得更多价值，尤其是在他们希望从 Microsoft Copilot 等生成式 AI 产品中获益时。这始于拥有安全且可访问的数据，确保能够在不影响安全态势的情况下扩展解决方案，并严格遵守日益复杂的监管标准。 另外，亚太地区量子计算项目的增加可能会推动“先收集，后解密”攻击的上升。此类攻击涉及对手收集并存储当前加密的数据，目的是在未来量子计算机足够强大时解密这些数据。这些攻击对需要长期保持安全的敏感信息构成了重大威胁。 根据《财富商业洞察》（Fortune Business Insights）的数据，亚太地区是全球增长最快的量子计算市场，包括 IBM 、微软、谷歌、阿里巴巴、百度、 JSR 和D-Wave 在内的多家公司目前正在参与该地区的大型量子软件和硬件项目。例如，阿里巴巴与中国科学院合作部署了新型量子计算云平台。亚太地区的一些量子项目正在国家层面进行，例如印度由美国资助的国家量子技术与应用任务和新加坡的量子工程项目。 Lee 表示，量子计算的出现可能会使当前的加密标准过时，导致敏感数据暴露并危及关键基础设施。随着组织为未来的解密威胁做准备，抗量子密码学将获得更多关注。 Green 指出，亚太地区的组织应预期到来自包括国家支持的黑客在内的‘先收集，后解密’攻击。这些攻击将对政府和企业、民用和军事通信、关键基础设施以及开发量子项目的组织构成威胁。 Qualys EMEA 和亚太区首席技术安全官兼解决方案架构副总裁 Richard Sorosina 认为，亚太地区威胁环境的快速演变和日益复杂化可能会加速该地区许多组织安全能力的整合。他预计，组织将越来越多地采用统一的安全平台方法，以提供对组织风险的集中视图，并在发现风险时提供修复机制。   转自FreeBuf，原文链接：https://www.freebuf.com/news/418742.html 封面来源于网络，如有侵权请联系删除

#技术教程 太烦 Microsoft Edge 浏览器？使用这个脚本可以一键彻底将其删除。可选删除 Microsoft Edge 浏览器本体或连同 WebView 全部删除，如果你不使

少数派广州体验店是我们在 2024 年底开始的新尝试，选在风景优美且极富老广州传统的荔湾湖公园里，定位是【数码 音乐 社区】。除了一如既往地展示少数派作为数码爱好者聚集地的属性外，我们还希望通过活动、

error code: 521

GitHub 安全实验室的安东尼奥-莫拉莱斯（Antonio Morales）最近发布了一份报告，公布了 GStreamer 中的 29 个漏洞，GStreamer 是一个开源多媒体框架，广泛应用于 Ubuntu、Fedora 和 openSUSE 等 Linux 发行版。GStreamer 支持广泛的多媒体功能，包括音频和视频解码、字幕解析和媒体流。它与 Nautilus、GNOME Videos 和 Rhythmbox 等关键应用程序的集成使其成为许多系统的重要组件，也成为网络攻击者的诱人目标。 莫拉莱斯在报告中解释说：“GStreamer 是一个大型库，包括 300 多个不同的子模块。在这项研究中，我决定只关注 Ubuntu 发行版默认包含的’Base’和’Good’插件。”这些插件支持 MP4、MKV、OGG 和 AVI 等流行编解码器，因此特别容易被利用。 在已发现的 29 个漏洞中，大多数是在 MP4 和 MKV 格式中发现的。以下是一些最值得注意的漏洞： CVE-2024-47537：isomp4/qtdemux.c.中的越界（OOB）写入。 CVE-2024-47538: vorbis_handle_identification_packet 中的堆栈缓冲区溢出。 CVE-2024-47607： gst_opus_dec_parse_header 中的堆栈缓冲区溢出。 CVE-2024-47615: gst_parse_vorbis_setup_packet 中的 OOB 写入。 CVE-2024-47539：convert_to_s334_1a 中的 OOB 写入。 这些漏洞包括 OOB 写入、堆栈缓冲区溢出和空指针取消引用，所有这些漏洞都可能允许攻击者执行任意代码、导致系统崩溃或外泄敏感信息。 GStreamer 在桌面环境和多媒体应用程序中的广泛使用凸显了这些漏洞的严重性。莫拉莱斯称：“该库中的关键漏洞可以打开许多攻击载体。例如，恶意制作的媒体文件可以利用这些漏洞入侵用户系统。” 为了发现这些漏洞，莫拉莱斯采用了一种新颖的模糊方法。由于大型媒体文件的大小和复杂性，传统的覆盖引导模糊器在处理大型媒体文件时往往会遇到困难。莫拉莱斯选择了一种定制方法： 他说：“我从头开始创建了一个输入语料生成器，”他介绍说，该技术生成了 400 多万个测试文件，专门用于发现 MP4 和 MKV 解析器中的罕见执行路径。 我们敦促开发人员和用户尽快更新到最新的 GStreamer 补丁版本。   转自安全KER，原文链接：https://www.anquanke.com/post/id/303158 封面来源于网络，如有侵权请联系删除

A vulnerability was found in Oracle Solaris 9/10. It has been classified as problematic. Affected is an unknown function of the component in.tnamed. The manipulation leads to denial of service. This vulnerability is traded as CVE-2012-3121. It is possible to launch the attack remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Oracle Solaris 8/9. It has been declared as problematic. This vulnerability affects unknown code of the component sort. The manipulation leads to an unknown weakness. This vulnerability was named CVE-2012-3122. An attack has to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Oracle Solaris 8/9/10 and classified as critical. Affected by this issue is some unknown functionality of the component TCP/IP. The manipulation leads to denial of service. This vulnerability is handled as CVE-2012-3125. The attack may be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability has been found in Oracle Solaris 10 and classified as problematic. This vulnerability affects unknown code of the component Apache HTTP Server. The manipulation leads to information disclosure. This vulnerability was named CVE-2012-3123. The attack can be initiated remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Oracle Solaris 10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Kernel/KSSL. The manipulation leads to denial of service. This vulnerability is known as CVE-2012-3124. The attack can be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability, which was classified as critical, has been found in Oracle Solaris 10. Affected by this issue is some unknown functionality of the component Gnome PDF viewer. The manipulation leads to denial of service. This vulnerability is handled as CVE-2012-3129. The attack may be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability has been found in Oracle Solaris 9/10/11 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Network/NFS. The manipulation leads to information disclosure. This vulnerability is known as CVE-2012-3131. The attack can be launched remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Oracle Solaris 8/9/10/11. It has been rated as problematic. Affected by this issue is some unknown functionality of the component mailx. The manipulation leads to denial of service. This vulnerability is handled as CVE-2012-3165. An attack has to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

阅读： 0威胁通告Adobe ColdFusion任意文件读取漏洞（CVE-2024-53961）通告热点资讯FortiWLM重大安全漏洞曝光，远程

A vulnerability was found in Microsoft SQL Server 7.0/2000. It has been classified as problematic. This affects an unknown part of the component Local Procedure Call Handler. The manipulation leads to improper privilege management. This vulnerability is uniquely identified as CVE-2003-0232. Attacking locally is a requirement. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as critical has been found in Microsoft SQL Server 7/2000. Affected is an unknown function of the component Named Pipe Handler. The manipulation leads to improper access controls. This vulnerability is traded as CVE-2003-0230. It is possible to launch the attack remotely. Furthermore, there is an exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Microsoft Internet Explorer 5.01/5.5/6.0 and classified as critical. This issue affects some unknown processing of the component CSS Handler. The manipulation of the argument input leads to improper privilege management. The identification of this vulnerability is CVE-2003-0116. The attack may be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Microsoft MSDE and SQL Server 7/2000. It has been rated as critical. This issue affects some unknown processing of the component Named Pipe Session Handler. The manipulation leads to improper access controls. The identification of this vulnerability is CVE-2003-0230. The attack may be initiated remotely. There is no exploit available. It is recommended to apply a patch to fix this issue.