Hello, welcome to the Friday, October 12, 2018 edition of the Sansanet Storm Center's Stormcast. My name is Johannes Ulrich and the I'm recording from Honolulu, Hawaii.

You may remember last year's equation editor vulnerability. The equation editor was a component of Microsoft Office. Microsoft Office has

since removed this component because, well, it was sort of one of those legacy components

that was apparently quite buggy. And Microsoft really didn't want to bother with maintaining

it anymore. But nevertheless, exploits still exist that try

to take advantage of these old vulnerabilities. Xavier just ran into some malicious spam that

exploited just this equation editor vulnerability. It actually didn't run it first in his sandbox because the

equation editor was no longer installed in it but once installed it would happily

download a Trojan and run it. And if you do own a Sony Pravia Smart TV, well

it's a time to update Sony released an update for these TVs,

fixing three vulnerabilities. The most critical of them is a command injection vulnerability.

When a user uploads an media file, the file name is mishandled and as a result arbitrary code can be executed.

The two other vulnerabilities are first of all a directory to reversal vulnerability that allows you to access files that you're not supposed to access

and the third and last vulnerability is a stack-based buffer overflow. The last vulnerability can be exploited via

an HTTP request, so this is potentially remotely executable. Now, you should never expose

these TVs to the open internet, so make sure your firewall blocks any access from outside

your network.

Now, while a lot of home networks rely on NAT to provide some basic isolation here,

remember that you may be running IPV6 on your home network.

Most ISPs supported now for home users, and while it may be very difficult for an attacker

to guess the TV's IP address, they certainly may be able to figure it out if you, for

example, use a web browser on the TV and use it to visit a malicious website.

...