PioLink’s BlueHunter Uncovers 28 Open-Source Vulnerabilities
IT DAILY · · 1 views
✦ AI Summary
PioLink said it discovered 28 undisclosed vulnerabilities after analyzing open-source software with its CTEM platform, BlueHunter.
The targets were 10 open-source services widely used on the Linux OS and 1 CMS, and 2 of the findings were assigned CVE numbers.
PioLink said it built reproduction environments and verified the issues before reporting them to the official maintainers, and that some vulnerabilities are being managed through official channels while undisclosed issues remain withheld in line with responsible disclosure principles.
PioLink announced on the 15th that it discovered 28 undisclosed vulnerabilities after analyzing open-source software through its CTEM platform, BlueHunter. The article photo shows the BlueHunter dashboard.
BlueHunter’s dashboard consists of a Blue mode for ASM and a Red mode for penetration testing. BlueHunter was developed by PioLink’s Threat Analysis Center.
PioLink’s Threat Analysis Center examined 10 open-source services widely used on the Linux OS and 1 CMS as analysis targets. As a result, it found 28 vulnerabilities that could trigger memory access errors and abnormal shutdowns.
Two of the discovered vulnerabilities were assigned CVE(Common Vulnerabilities and Exposures) numbers. Information about these issues is scheduled to be made public in December.
PioLink said it built reproduction environments for each vulnerability, verified them, and then reported them to the official maintainers of the relevant open-source projects. The official maintainers confirmed the related issues and said some vulnerabilities are being managed through official channels.
The two sides are working together on a technical review of the vulnerabilities’ scope of impact and possible remediation measures. However, because security patches and official disclosure procedures have not yet been completed for some vulnerabilities, PioLink said it has decided not to disclose the software names or attack methods in order to minimize the possibility of abuse. It said this nondisclosure policy is based on the principle of 'responsible disclosure,' in which developers are notified first after a vulnerability is found and given time to fix it.
PioLink CEO Jo Young-chul said that AI-powered attacks are spreading. He added that defenses need to evolve in a way that detects potential vulnerabilities before attackers do. He also said the company plans to continue proactively identifying security threats with BlueHunter and to strengthen software supply chain security by working with open-source projects.
Source: IT DAILY · Kim Ho-jun
Original: https://www.itdaily.kr/news/articleView.html?idxno=242199
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.