Hello, welcome to the Tuesday, March 5th, 2019 edition of the San Bernard Storm Center's Stormcast.

My name is Johannes Ulrich and today I'm recording from Jacksonville, Florida.

Google release details regarding an interesting copy on write vulnerability in a Mac OS. This vulnerability could be used to override files and

essentially gets you privilege escalation. Google notified Apple of the vulnerability and

released these details 90 days after Apple received notice. There is a proof of concept exploit that Google did publish

as part of these details. Not really much that you can do about this at this point other than

wait for Apple to release a patch. And then we have a new update for Windows Exploid Suggester.

This is a tool that many penetration testers may remember, but it stopped working about two years ago

because Microsoft switched from the bulletin-based vulnerability system to the new XML API and no longer

published bulletin.

So with that, essentially the parser that Windows Exploidsuggester used in order to learn

about new vulnerabilities broke.

Well, this latest update fixes this problem. It now uses the Microsoft XML API

to retrieve vulnerability data. But well, there are a lot of tools out there that will tell you

what you haven't patched on your system. What really makes Windows Exploids Suggester different is that it will actually tell you if any of these vulnerabilities are exploitable, and then it will suggest, as the name implies, exploits to use against these vulnerabilities.

This is, of course, really important if you're trying to prioritize what to patch, and if you're really sort of trying to determine

what risk you're exposing yourself to.

And of course it makes life easier for penetration testers if they don't already have a tool like this

that will match up vulnerabilities to exploits.

And then there are more reports of the recent Docker run C vulnerability being exploited

to install cryptocurrency miners.

The latest version of this discovery comes from Imperva, from Vitali Simonovic and Ori Nakar.

...