Feliratkozás hírcsatorna csatornájára
CERT publishes vulnerability advisories called "Vulnerability Notes." Vulnerability Notes include summaries, technical details, remediation information, and lists of affected vendors. Many vulnerability notes are the result of private coordination and disclosure efforts.
Frissítve: 48 perc 41 másodperc

VU#531281: Microsoft Windows DNS servers are vulnerable to heap overflow

p, 01/04/2019 - 19:01
CWE-122:Heap-based Buffer Overflow - CVE-2018-8626 Microsoft Windows Domain Name System(DNS)servers are vulnerable to heap overflow attacks. Microsoft acknowledges that"an attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Local System Account."This remote code execution vulnerability exists in Windows DNS servers when they fail to properly handle requests.
Kategóriák: Biztonsági hírek

VU#289907: Microsoft Windows Kernel Transaction Manager (KTM) is vulnerable to a race condition

p, 01/04/2019 - 17:11
CWE-362:Concurrent Execution using Shared Resource with Improper Synchronization('Race Condition')- CVE-2018-8611 According to Microsoft,the Windows kernel fails"to properly handle objects in memory". A successful attacker could run arbitrary code in kernel mode,and then"install programs; view,change,or delete data; or create new accounts with full user rights."
Kategóriák: Biztonsági hírek

VU#228297: Microsoft Windows MsiAdvertiseProduct function vulnerable to privilege escalation via race condition

cs, 12/20/2018 - 22:11
The Microsoft Windows MsiAdvertiseProduct function allows a Windows installer product to generate a script to advertise a product to Windows,which handles shortcut and registry information associated with an installed application. The MsiAdvertiseProduct contains a race condition while performing checks,which can allow an attacker to read an arbitrary file which would otherwise be protected with filesystem ACLs. Exploit code for this vulnerability is publicly available.
Kategóriák: Biztonsági hírek

VU#741315: A Dokan file driver contains a stack-based buffer overflow

cs, 12/20/2018 - 21:49
CWE-121:Stack-based Buffer Overflow - CVE-2018-5410 Dokan,versions between and,are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the version update.
Kategóriák: Biztonsági hírek

VU#573168: Microsoft Internet Explorer scripting engine JScript memory corruption vulnerability

sze, 12/19/2018 - 23:35
Microsoft Internet Explorer contains a scripting engine,which handles execution of scripting languages such as VBScript and JScript. The scripting engine JScript component contains an unspecified memory corruption vulnerability. Any application that supports embedding Internet Explorer or its scripting engine component may be used as an attack vector for this vulnerability. This vulnerability was detected in exploits in the wild.
Kategóriák: Biztonsági hírek

VU#756913: Pixars Tractor contains a stored cross-site scripting vulnerability

cs, 12/13/2018 - 16:24
CWE-79:Improper Neutralization of Input During Web Page Generation - CVE-2018-5411 Pixar's Tractor software,versions 2.2 and earlier,contain a stored cross-site scripting vulnerability in the field that allows a user to add a note to an existing node. The stored information is displayed when a user requests information about the node. An attacker could insert Javascript into this note field that is then saved and displayed to the end user.
Kategóriák: Biztonsági hírek

VU#395981: Self-Encrypting Drives Have Multiple Vulnerabilities

sze, 11/07/2018 - 00:20
CVE-2018-12037 There is no cryptographic relation between the password provided by the end user and the key used for the encryption of user data. This can allow an attacker to access the key without knowing the password provided by the end user,allowing the attacker to decrypt information encrypted with that key. According to National Cyber Security Centre - The Netherlands(NCSC-NL),the following products are affected by CVE-2018-12037: Crucial(Micron)MX100,MX200 and MX300 drives Samsung T3 and T5 portable drives Samsung 840 EVO and 850 EVO drives(In"ATA high" mode these devices are vulnerable,In"TCG"or"ATA max"mode these devices are NOT vulnerable.) CVE-2018-12038 Key information is stored within a wear-leveled storage chip. Wear-leveling does not guarantee that an old copy of updated data is fully removed. If the updated data is written to a new segment,old versions of data may exist in the previous segment for some time after it has been updated(until that previous segment is overwritten). This means that if a key is updated with a new password,the previous version of the key(either unprotected,or with an old password)could be accessible,negating the need to know the updated password. According to NCSC-NL,the following products are affected by CVE-2018-12038: Samsung 840 EVO drives Other products were not reported to have been tested,and similar vulnerabilities may be found in those products.
Kategóriák: Biztonsági hírek

VU#339704: Cisco ASA and FTD SIP Inspection denial-of-service vulnerability

h, 11/05/2018 - 20:20
Cisco Adaptive Security Appliance(ASA)software and Cisco Firepower Threat Defense(FTD)software fails to properly parse SIP traffic,which can allow an attacker to trigger high CPU usage,resulting in a denial-of-service condition on affected devices. This vulnerability is exposed if SIP Inspection is enabled on affected devices,which is the default configuration on ASA devices. The Cisco SIP Inspection feature is advertised to"... enforce the sanity of the SIP messages,as well as detect SIP-based attacks."
Kategóriák: Biztonsági hírek

VU#317277: Texas Instruments Microcontrollers CC2640 and CC2650 are vulnerable to heap overflow

p, 11/02/2018 - 21:44
CWE-119:Improper Restriction of Operations within the Bounds of a Memory Buffer - CVE-2018-16986 Both Texas Instruments microcontrollers CC2640 and CC2650 BLE-Stacks contain a memory corruption vulnerability resulting from the mishandling of BLE advertising packets. The function llGetAdvChanPDU that is part of the embedded ROM image in both chips handles the incoming advertising packets and parses their headers. It copies the contents to a separate buffer provided by the calling function. The incorrect length of the packet is taken and end up being parsed as larger packets than originally intended. If the incoming data is over a certain length,the function will call the halAssertHandler function,as defined by the application running on top of the stack,and not stop execution. Since the flow of execution does not stop,it will copy the overly large packet to the buffer and cause a heap overflow.
Kategóriák: Biztonsági hírek

VU#317277: Texas Instrument Microcontrollers CC2640 and CC2650 are vulnerable to variable and heap overflow.

cs, 11/01/2018 - 17:45
Texas Instrument Microcontrollers CC2640 and CC2650 are vulnerable to variable and heap overflow.
Kategóriák: Biztonsági hírek

VU#339704: Cisco ASA and FTD SIP Inspection denial-of-service vulnerability

cs, 11/01/2018 - 17:12
Cisco Adaptive Security Appliance(ASA)Software and Cisco Firepower Threat Defense(FTD)software fails to properly parse SIP traffic,whcih can result in a denial-of-service condition on affected devices.
Kategóriák: Biztonsági hírek

VU#581311: TP-Link EAP Controller lacks RMI authentication and is vulnerable to deserialization attacks

p, 10/26/2018 - 21:40
CWE-306:Missing Authentication for Critical Function - CVE-2018-5393 EAP Controller for Linux utilizes a Java remote method invocation(RMI)service for remote control. The RMI interface does not require any authentication before use. Remote attackers can implement deserialization attacks through the RMI protocol. Successful attacks may allow a remote attacker to remotely control the target server and execute Java functions or bytecode. CWE-502:Deserialization of Untrusted Data - CVE-2015-6420 EAP Controller for Linux bundles a vulnerable version of Apache commons-collections v3.2.1 with the software,which appears to be the root cause of the vulnerability. Therefore,EAP Controller v2.5.3 and earlier are vulnerable to CVE-2015-6420 as documented in VU#576313. EAP Controller v2.5.3 and earlier for Linux are affected by both vulnerabilities.
Kategóriák: Biztonsági hírek

VU#598349: Automatic DNS registration and proxy autodiscovery allow spoofing of network services

k, 10/23/2018 - 19:34
The Web Proxy Automatic Discovery(WPAD)protocol is used to automatically provide proxy configuration information to devices on a network. Clients issue a special DHCP request to obtain the information for the proxy configuration,but will fall back on a DNS request to one of several standardized URLs making use of the subdomain name of“wpad” if a DHCP response is unavailable. An attacker with local area network(LAN)access may be able to add a device with the name“wpad” to the network,which may produce a collision with a standardized WPAD DNS name. Many customer premise home/office routers(including,but not limited to,Google Wifi and Ubiquiti UniFi)automatically register device names as DNS A records on the LAN,which may allow an attacker to utilize a specially named and configured device to act as a WPAD proxy configuration server. The attacker-served proxy configuration can result in the loss of confidentiality and integrity of any network activity by any device that utilizes WPAD. Other autodiscovery names such as ISATAP may also be exploitable.
Kategóriák: Biztonsági hírek

VU#176301: Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App

k, 10/16/2018 - 20:51
CWE 798:୕se of Hard-Coded Credentials - CVE–2018-5399 The DCU 210E firmware contains an undocumented Dropbear SSH server with a hardcoded username and password. The password is easily susceptible to cracking. CWE-346:୏rigin Validation Error - CVE–2018-5400 The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. CWE-319:ୃleartext Transmission of Sensitive Information - CVE–2018-5401 The devices transmit process control information via unencrypted Modbus communications. CWE-319:ୃleartext Transmission of Sensitive Information - CVE–2018-5402 The embedded webserver uses unencrypted plaintext for the transmission of the administrator PIN.
Kategóriák: Biztonsági hírek

VU#641765: Linux kernel IP fragment re-assembly vulnerable to denial of service

p, 10/12/2018 - 14:31
CWE-400:Uncontrolled Resource Consumption('Resource Exhaustion')- CVE-2018-5391 The Linux kernel,versions 3.9+,is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly. An attacker may cause a denial of service condition by sending specially crafted IP fragments. Various vulnerabilities in IP fragmentation have been discovered and fixed over the years. The current vulnerability(CVE-2018-5391)became exploitable in the Linux kernel with the increase of the IP fragment reassembly queue size.
Kategóriák: Biztonsági hírek

VU#176301: Auto-Maskin DCU 210E RP 210E and Marine Pro Observer App

szo, 10/06/2018 - 15:14
Auto-Maskin RP remote panels and DCU controls units are used to monitor and control ship engines. The units have several authentication and encryption vulnerabilities which can allow attackers to access the units and control connected engines.
Kategóriák: Biztonsági hírek

VU#332928: Ghostscript contains multiple -dSAFER sandbox bypass vulnerabilities

h, 10/01/2018 - 21:38
Ghostscript contains an optional -dSAFER option,which is supposed to prevent unsafe PostScript operations. Multiple PostScript operations bypass the protections provided by -dSAFER,which can allow an attacker to execute arbitrary commands with arbitrary arguments. This vulnerability can also be exploited in applications that leverage Ghostscript,such as ImageMagick,GraphicsMagick,evince,Okular,Nautilus,and others. Exploit code for this vulnerability is publicly available.
Kategóriák: Biztonsági hírek