Hello, welcome to the Friday, May 8th, 2020 edition of the Sandstone Storm Center's Stormcast.

My name is Johannes Ulrich.

I'm recording, well, from Jacksonville, Florida, of course.

I always tell people if there's a tool that you're using a lot for many, many years.

It doesn't hurt to look at the man page once ever so often or

whatever documentation is available. Case in point, we got a diary today from Boyan about all

these NSE scripts that are coming with NMAP. When I grew up, well, NMAP was a port scanning tool, but it has really become

more and more sort of a full-fledged vulnerability scanner, and Boyan is going over some of the more

useful NSE scripts that are included in NMAP. In the past, he had sometimes Manuel write about

some of these scripts, but

certainly worthwhile to revisit NMAP and check out what scripts are available, and of course,

the number is steadily growing. And Apple apparently fixed a three-year-old sandbox escape vulnerability in the latest beta of iOS,

which will eventually be released as iOS 13.5.

A couple details were released today by Sigusa, who originally discovered this vulnerability about three years ago.

And it's a pretty kind of interesting in the way how simple this sandbox escape is vulnerability.

The core of the problem is that Apple uses four different XML parsers as part of iOS, and configuration files for apps

are stored in property lists or P-list files, which are formatted in XML.

Now, these property lists include all kinds of entitlements that a particular application possesses, and due to the buck in the XML parser, comments aren't parsed correct, or at least differently, by two different XML parsers.

So an attacker would create an XML file, sign it properly, but the important entitlement,

in this case it would be Com Apple Private Security No Container that allows the software to escape

from the sandbox would only be visible in one of these parsers and ignored in the other parsers. So all currently released

versions of iOS are vulnerable. This will hopefully be fixed soon with the release of iOS

...