Hello and welcome to the Friday, May 10th, 2020, 4 edition of the Santernet Storm Center's Stormcast.

My name is Johannes Orich, and I'm recording from San Diego, California.

You've got a great diary today by Didi, where yet again, he is improving one of his tools.

If you're analyzing a PDF, there may be multiple PDF streams present.

The old tool PDF parser.Py did allow you to extract individual streams, but well, if there are a lot of them, that's kind of tedious.

So users asked for all of the PDF streams. individual streams, but well, if there are a lot of them, that's kind of tedious, so users

asked for all of the PDF streams to be exported as at once, and that's exactly what

did he added in version 079 of PDF parser.py.

Even better, the output is in JSON format that can then be post-processed with other tools in DDA's

famous toolset. So you can decompress, you can analyze the mind type of different streams and all of this,

all by just piping JSON output from one tool into the next to further process the data.

Nice examples here from Didi as part of the diary, if you're interested in more details.

And F5 published an update for its next central manager product. Next is the name of

product series for F5, which of the next generation of products. And central manager is the tool that you're

using to administer these different products. The vulnerabilities were found by Eclipse

and their total of five vulnerabilities, but only two of them received CVE numbers. These two

vulnerabilities are sequel injection vulnerabilities. One of them received CVE numbers. These two vulnerabilities are SQL injection vulnerabilities.

One of them actually requires LDAP to be enabled. The second one apparently doesn't.

These SQL injection vulnerabilities are explained in Eclipseum's blog post, including a proof of concept that does retrieve the

admin's password hash. The other vulnerabilities are less severe, which is why they may not have

gotten a CVE number, like for example, a B-Crypt hash that doesn't use a sufficient cost with call is a minor thing.

The one thing that I'm actually a little bit concerned about, there is a vulnerability that allows

...