Tencent Security Xuanwu Lab Daily News
• BrokenPrint: A Netgear stack overflow:
https://research.nccgroup.com/2022/02/28/brokenprint-a-netgear-stack-overflow/
・ Netgear R6700v3 KC_PRINT 服务栈溢出漏洞分析
– Jett
• GitHub – find-sec-bugs/find-sec-bugs: The SpotBugs plugin for security audits of Java web applications and Android applications. (Also work with Kotlin, Groovy and Scala projects):
https://github.com/find-sec-bugs/find-sec-bugs
・ 在 Java Web 以及 Android 项目中自动检测漏洞的插件
– Jett
• [PDF] https://arxiv.org/pdf/2202.12336.pdf:
https://arxiv.org/pdf/2202.12336.pdf
・ 利用 Partially Recompilable Decompilation 技术重写 x86 二进制程序实现无源码程序的漏洞 Mitigation
– Jett
• [PDF] https://www.s3.eurecom.fr/docs/eurosp22_mantovani.pdf:
https://www.s3.eurecom.fr/docs/eurosp22_mantovani.pdf
・ 从数据依赖图的角度来衡量被 Fuzz 程序的覆盖度
– Jett
• CVE-2021-30955 PoC:
https://gist.github.com/jakeajames/37f72c58c775bfbdda3aa9575149a8aa#file-writeup-pdf
・ 前两天公开的 XNU CVE-2021-30955 漏洞的 PoC
– Jett
• SIM Hijacking（译文）:
https://tttang.com/archive/1446/
・ SIM Hijacking（译文）
– lanying37
• [Tools] Dyld Shared Cache Parser:
https://github.com/cxnder/bn-dyldsharedcache
・ 用于 BinaryNinja 分析 Dyld Shared Cache 的插件
– Jett
• [Tools] srg-imperial/SaBRe:
https://github.com/srg-imperial/SaBRe
・ SaBRe – Modular Selective Binary Rewriter
– Jett
• [PDF] https://info.mitre-engenuity.org/hubfs/Center%20for%20Threat%20Informed%20Defense/CTID-Sightings-Ecosystem-Report.pdf?utm_campaign=CTID%20Sightings%20Report&utm_source=share-social&utm_content=sightings-ecosystem-report:
https://info.mitre-engenuity.org/hubfs/Center%20for%20Threat%20Informed%20Defense/CTID-Sightings-Ecosystem-Report.pdf?utm_campaign=CTID%20Sightings%20Report&utm_source=share-social&utm_content=sightings-ecosystem-report
・ Sightings Ecosystem: A Data-driven Analysis of ATT&CK in the Wild
– Jett
• Linux内核eBPF RINGBUF越界访问漏洞（CVE-2021-3489）利用分析:
https://mp.weixin.qq.com/s/biSNUlzZqqcYiYwfMSaTeg
・ Linux内核eBPF RINGBUF越界访问漏洞（CVE-2021-3489）利用分析
– Jett
* 查看或搜索历史推送内容请访问：
https://sec.today
* 新浪微博账号：腾讯玄武实验室
https://weibo.com/xuanwulab
原文始发于微信公众号（腾讯玄武实验室）：每日安全动态推送(03-01)
