Hello, welcome to the Friday, June 8th, 2018 edition of the Zanzan and Storm Center's Stormcast.

My name is Johannes Ulrich, and today I'm recording from Augusta, Georgia.

On Thursday, Adobe released a surprise update for Flash Player.

This update fixes a single vulnerability, which apparently has already been exploited

in attacks against targets in the Middle East.

So at this point, only in very specific targeted attacks, there is no public exploit available

as far as I can tell, but you probably should patch this vulnerability

quickly and researchers with Eclipse published a blog post with details regarding

two vulnerabilities in super micro firmer super micro is quite popular in the server space and also some

security appliances are based on Super Micro hardware. Now the two vulnerabilities

aren't necessarily easily exploitable. The first one and I think probably the more

critical one here is a misconfiguration of the flash descriptor region.

This is a specific region that's used for flash memory and typically it should be immutable.

But apparently in some super micro systems this region is actually writable, so malware on the system may be able to override this region.

The second vulnerability I consider less problematic because exploitation requires physical access to the server and that's essentially insecure updates. So an attacker with physical access to the server and that's essentially insecure updates.

So an attacker with physical access to the server may install a malicious firmer update.

While this attack is difficult to perform, it's also very difficult to detect and to recover from. And FOSCAM, the manufacturer of popular low-cost video cameras,

has released firmware updates that you probably should apply rather quickly.

These updates fix three different vulnerabilities.

No details have been released yet, just a very generic blog post by the team that actually discovered these vulnerabilities.

But based on recent history, it probably won't take too long for details about these vulnerabilitiesabes to become known and for exploits to take

advantage of them regardless of whether or not you're applying in this update you should never

...