[ASA-201811-22] samba: multiple issues

Arch Linux Security Advisory ASA-201811-22 ========================================== Severity: High Date : 2018-11-28 CVE-ID : CVE-2018-14629 CVE-2018-16841 CVE-2018-16851 CVE-2018-16852 CVE-2018-16853 CVE-2018-16857 Package : samba Type : multiple issues Remote : Yes Link :...

CVE-2018-16857: Improperly Implemented Security Check for Standard

Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords to restrict brute forcing of passwords in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been...

FreeBSD : samba -- multiple vulnerabilities (54976998-f248-11e8-81e2-005056a311d1)

The samba project reports : All versions of Samba from 4.0.0 onwards are vulnerable to infinite query recursion caused by CNAME loops. Any dns record can be added via ldap by an unprivileged user using the ldbadd tool, so this is a security issue. When configured to accept smart-card...

CVE-2018-16853: Uncontrolled Resource Consumption

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore t...

Cheetah Mobile Blames SDKs for Rampant Ad Fraud in Its Android Apps

Cheetah Mobile is finding itself in a swirl of media attention after being accused of developing mobile apps that contain deliberate ad fraud features. But the mobile giant says it didn’t do it. The Chinese developer, which is listed as a top provider in Google Play’s tool app category, offers...

8 Popular Android Apps Caught Up In Million-Dollar Ad Fraud Scheme

Cheetah Mobile —a prominent Chinese app company, known for its popular utility apps like Clean Master and Battery Doctor—and one of its subsidiary Kika Tech have allegedly been caught up in an Android ad fraud scheme that stole millions of dollars from advertisers. According to app analytics firm...

8 Popular Android Apps Caught Up In Million-Dollar Ad Fraud Scheme

Cheetah Mobile—a prominent Chinese app company, known for its popular utility apps like Clean Master and Battery Doctor—and one of its subsidiary Kika Tech have allegedly been caught up in an Android ad fraud scheme that stole millions of dollars from advertisers. According to app analytics firm...

3ve – Fraudulent Online Advertising

The Department of Homeland Security and the Federal Bureau of Investigation have released a joint Technical Alert TA on a major online ad fraud operation—referred to by the U.S. Government as "3ve." NCCIC encourages users and administrators to review Alert TA18-331A: 3ve – Major Online Ad Fraud...

CVE-2018-16853

Samba from version 4.7.0 has a vulnerability that allows a user in a Samba AD domain to crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory the Samba Team clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore t...

CVE-2018-16857

Samba from version 4.9.0 and before version 4.9.3 that have AD DC configurations watching for bad passwords to restrict brute forcing of passwords in a window of more than 3 minutes may not watch for bad passwords at all. The primary risk from this issue is with regards to domains that have been...

Samba AD DC S4U2Self Crash in experimental

Description A user in a Samba AD domain can crash the KDC when Samba is built in the non-default MIT Kerberos configuration. With this advisory we clarify that the MIT Kerberos build of the Samba AD DC is considered experimental. Therefore the Samba Team will not issue security patches for this...

Scientific Linux Security Update : sssd on SL7.x x86_64 (20181030)

Security Fixes : - sssd: information leak from the sssd-sudo responder CVE-2018-10852 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include'compat.inc'; if description scriptid119200; scriptversion"1.5"; scriptsetattributeattribute:"pluginmodificationdate",...

Unified hosts File With Base Extensions: hosts

Extending and consolidating hosts files from several well-curated sources like adaway.org, mvps.org, malwaredomainlist.com, someonewhocares.org, and potentially others. You can optionally invoke extensions to block additional sites by category. The unified hosts file is extensible. Extensions are...

Safeguard Your Data And Privacy Online With This Award-Winning VPN

It seems as though not a day goes by without a new story breaking about a high-level cyber attack on a major corporation or national government. Hackers are becoming increasingly adept at breaking through a variety of super-secure firewalls, and they're not just after the riches of Fortune 500...

Cross site scripting

A cross-site-scripting XSS vulnerability exists when an open source customization for Microsoft Active Directory Federation Services AD FS does not properly sanitize a specially crafted web request to an affected AD FS server, aka "Active Directory Federation Services XSS Vulnerability." This...

CVE-2018-8547

CVE-2018-8547 is a cross-site scripting (XSS) vulnerability in an open-source customization for Microsoft Active Directory Federation Services (AD FS). Affected components are AD FS servers on Windows platforms (e.g., Windows Server 2012 R2, 2016, 2019, etc.). The issue arises because the customi...

Microsoft Windows Multiple Vulnerabilities (KB4467697)

This host is missing a critical security update according to Microsoft KB4467697. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

A week in security (November 5 – 11)

Last week on Malwarebytes Labs, we looked at browser lockers that fly under the radar with complete obfuscation, transport and logistics in our series about compromising vital infrastructure, Google logins now requiring JavaScript, how to create a sticky cybersecurity training program, and an...

Updated ansible package fixes security vulnerabilities

It was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result CVE-2018-10874. It was found that ansible.cfg is being read from the current working directory, which can be...

Google logins: JavaScript now required

Google users: In news that may sound alarming, it is now a requirement for you to enable JavaScript. Why? When your username and password are entered on Google’s sign-in page, Google runs a risk assessment and only allows the sign-in if nothing looks suspicious. Recently, Google went about...