Hello, welcome to the Friday, April 24, 2020 edition of the Sansonet Storm Center's Stormcast.

My name is Johannes Ulrich, and I'm recording from Jacksonville, Florida.

Yesterday I mentioned that OpenSSSL released an update fixing one denial of service service vulnerability CV 2020-1967.

While the vulnerability isn't really all that noteworthy, I find, it's after all just a

denial of service vulnerability. What's sort of interesting is a little bit the backstory that was now

released about this vulnerability in how it was found. Developers are not only sort of releasing code faster as part

of this DevOps movement, but also are trying to sort of integrate more and more security

tools into the development process. And open source software is certainly not falling behind here.

The Knew C compiler, also known as GCC, is including in its latest version, version 10, static

code analysis tool in the compiler itself.

So the compiler can warn you about any potential security problems.

And apparently this new feature in GCC did lead to the discovery of this vulnerability in OpenSSL.

I think it's so far also interesting that OpenSSL, of course, over the last few years has gotten a lot of attention, so it has been audited, has been run through some tools like this.

So nice to see how this new tool in GCC immediately led to discovery of a new flaw, and of course also to fixing the new flaw.

And IBM patched a critical vulnerability in its Spectrum Protect Server.

This is a fairly sort of massive complex enterprise backup system.

And the vulnerability stack-based buffer overflow can lead to arbitrary remote code execution

and has been assigned a CBSS score of 9.8, which is almost as high as it goes.

So if you're running this software, this server, please make sure that you patch it. Now, typically, this is sort of at the

core of the enterprise. There's nothing that should ever really be exposed, but of course,

being responsible for all the backups within a company, there is a lot of data that an attacker

would have access to if they can compromise this server.

...