Podcast Detail

SANS Stormcast Thursday, July 30th, 2026: Apple Patches; IPMI Admin PW Hash Leak; VMWare Patches; OpenWRT Patch

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10030.mp3

previous
Podcast Logo
Apple Patches; IPMI Admin PW Hash Leak; VMWare Patches; OpenWRT Patch
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Thursday, July 30th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in Cyber
 Defense Operations. Well, a little sort of postscript to
 Apple's patches from a couple days ago. There were three
 patches that addressed malicious crafted ZIP archives
 that may bypass Gatekeeper. Now, these affect the BOM,
 LibArchive and other components. That's why they're
 three different CVE assigns to what sounds essentially like
 the same vulnerability. This also sounds very much like the
 vulnerability that was discussed by the Mysk blogs
 from, I think, early this week is when I covered it just a
 couple days before the Apple patches were released. Now,
 Mysk does state that this release does not fix the
 problem that they actually discovered and described. I
 haven't had a chance yet to test this myself. Now, there's
 another bug that Mysk did discuss in their blog that is
 actually fixed. And that's the ability of websites to access
 the clipboard. And that's certainly a rather unpleasant
 issue. I don't want to call it critical. But yes, that
 particular issue is patched. But apparently, the sort of
 archive, and I think Mysk was particularly talking about Tor
 archives, not about ZIP archives. So maybe there are
 different vulnerabilities in other sort of no archive or
 compressed file format packages. And Michael
 Kaczynski with Lava HQ did publish a blog post with an
 interesting old vulnerability in IPMI. IPMI is the out-of
 -band management protocol. It's implemented by many
 baseboard management controllers or BMCs in order
 to allow access to systems that are essentially shut
 down. So you can remote power up and you can reboot systems
 and basically get the basic access to a system in order to
 recover it, for example, from a crash. What's also kind of
 interesting is that this interface is often enabled as
 long as the system is plugged into power and plugged into
 the network, even if it appears to be turned off. Now,
 the problem they found is that the IPMI authentication
 protocol that has been around for 20-something years may
 return the HMAC SHA-1 hash of the admin password. It uses
 the HMAC SHA-1 of the admin's password as a key here for
 this authentication protocol. And yes, SHA-1 is not that
 terrible, difficult to break. And as a result, well, 30% of
 the passwords that they could collect from scanning the
 internet were recoverable. Now, this interface is
 reachable on UDP port 623. And you basically would establish
 a connection to this port as an attacker. And then during
 the initial authentication handshake, you would receive
 the hash of the admin password. First thing, of
 course, UDP port 623 shouldn't be exposed to the world in the
 first place. And definitely any kind of control plane
 communication like this has to be carefully controlled. And
 these IPMI interfaces probably should be connected to some
 kind of administrative network that's also not reachable from
 outside your network. And Broadcom did release updates
 for its VMware virtualization products. And now many of them
 are affected, vCenter, VMware Fusion, and the like. But
 there are two vCenter vulnerabilities that
 particular stick out. One is a directory traversal in syslog.
 Would like to know more details about this. Sounds
 really interesting, but apparently can lead to
 arbitrary code execution by just sending syslog packets to
 your vCenter server. There's also an authentication bypass
 vulnerability that can lead to then arbitrary code execution
 that can be exploited by just connecting via the network to
 the admin interface. So definitely remotely
 exploitable. Again, vCenter admin interfaces probably
 shouldn't be exposed to the internet. And you probably
 also shouldn't accept random syslog messages from across
 the internet. But in the second one, well, it may be
 something that I could see people allowing to happen to
 collect from any kind of remote sites, some syslogs.
 And when I often talk about vulnerabilities in big
 expensive enterprise gateways, sometimes it's also the small
 sort of free home or small business gateways that have
 problems. OpenWrt came up with a new version. Now this fixes
 the current major version as well as the one before that
 only receives security updates at this point. There's one
 vulnerability in particular I want to point a little bit
 attention to and that's a buffer overflow in ODH CDP.
 This is the DHCP server that comes with OpenWrt. The DHCP
 v6 feature does have this stack based buffer overflow
 that may lead to arbitrary code execution. In particular,
 of course, if stack canaries or ASLR is not enabled, which
 you often have sort of in these embedded devices. That's
 something that specifically sort of point out in the
 advisory. CVSS score of this is 9.8. So definitely get your
 devices updated. And also there are some devices that
 you may not realize run this ODH CDP. I think GLINet is
 pretty heavily based on OpenWrt, their firmware. So
 that may be one spot where you should expect an update if
 they haven't already pushed it out. Well, and this is it for
 today. So thanks for listening. Thanks for
 subscribing. Thanks for recommending this podcast. And
 as always, talk to you again tomorrow. Bye.