CB Customer Spotlight: Q&A with Kaas Tailored’s Joe Mrazik

For the past eight years, Joe Mrazik has taken on the role of Network Administrator for Kaas Tailored, protecting the company’s endpoints with CB Defense. Kaas Tailored is an aerospace and furniture manufacturing company that supplies parts to aerospace companies like Boeing. Read on to learn how...

PT-2022-11257 · Gpac +1 · Gpac +1

Name of the Vulnerable Software and Affected Versions: Gpac versions through 1.0.1 Description: A null pointer dereference vulnerability exists via the gf avc parse nalu function in av parsers.c when using mp4box, which causes a denial of service. This issue leads to a segmentation fault...

Sql injection

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

CVE-2018-12238

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

Sql injection

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

CVE-2018-12238

CVE-2018-12238 is an AV bypass affecting Norton/Symantec endpoint products. Affected include Norton prior to 22.15; Symantec Endpoint Protection (SEP) prior to 12.1.7454.7000 and 14.2; SEP SBE prior to NIS-22.15.1.8 and SEP-12.1.7454.7000; and SEP Cloud prior to 22.15.1. The issue enables evading...

CVE-2018-12238

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

CVE-2018-12239

CVE-2018-12239 affects Norton 22.15 and certain Symantec Endpoint Protection (SEP) lines prior to 12.1.7454.7000 and 14.2, SEP SBE prior to NIS-22.15.1.8/SEP-12.1.7454.7000, and SEP Cloud prior to 22.15.1. The issue is an AV bypass vulnerability where one antivirus engine relies on a signature da...

CVE-2018-12239

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

CVE-2018-12238: Undefined Security Weakness

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

CVE-2018-12239: Undefined Security Weakness

Norton prior to 22.15; Symantec Endpoint Protection SEP prior to 12.1.7454.7000 & 14.2; Symantec Endpoint Protection Small Business Edition SEP SBE prior to NIS-22.15.1.8 & SEP-12.1.7454.7000; and Symantec Endpoint Protection Cloud SEP Cloud prior to 22.15.1 may be susceptible to an AV bypass...

SEP Multiple Issues

SUMMARY Symantec has released updates to address issues that were discovered in the Norton, Symantec Endpoint Protection SEP, Symantec Endpoint Protection Small Business Edition SEP SBE and Symantec Endpoint Protection Cloud SEP Cloud products. AFFECTED PRODUCTS Norton --- CVE | Affected Versions...

Why Malwarebytes decided to participate in AV testing

Starting this month, Malwarebytes began participating in the antivirus software for Windows comparison test performed by AV-test.org. This is uncharted territory for us, as we have refrained from participating in these types of tests since our inception. Although recent testing results show...

Emotet Campaign Ramps Up with Mass Email Harvesting Module

A large-scale spam campaign has launched, spreading the Emotet banking trojan. Worryingly, the offensive has launched about a week after a fresh module for mass email-harvesting was detected for the malware. Emotet is technically a banking trojan, but it’s most often used as a dropper for a varie...

Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV

Consider this scenario: Two never-before-seen, heavily obfuscated scripts manage to slip past file-based detection and dynamically load an info-stealing payload into memory. The scripts are part of a social engineering campaign that tricks potential victims into running the scripts, which use the...

Adwind RAT Scurries By AV Software With New DDE Variant

A newly-discovered spam campaign is spreading the Adwind 3.0 remote-access tool RAT – and using a fresh take on the Dynamic Data Exchange DDE code-injection technique for anti-virus evasion. The spam campaign features two types of droppers that leverage a new variant to the already-known DDE...

Adwind Dodges AV via DDE

This blog post is authored by Paul Rascagneres, Vitor Ventura and with the contribution of Tomislav Pericin and Robert Perica from ReversingLabs. Introduction Cisco Talos, along with fellow cybersecurity firm ReversingLabs, recently discovered a new spam campaign that is spreading the Adwind 3.0...

Microsoft Windows Defender AV: Block Win32 imports from macro code in Office

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavblockwin32importoffice.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Configure Attack Surface Reduction rules: Block Win32 imports from macro code in Office Authors: Emanuel Moss Copyright: Copyright c 2018...

Microsoft Windows Defender AV: Threat alert levels at which default action should not be taken (Medium)

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winavthreatseveritydefaultaction2.nasl 11495 2018-09-20 10:06:25Z emoss $ Check value for Specify threat alert levels at which default action should not be taken when detected Medium Authors: Emanuel Moss Copyright: Copyright...

Microsoft Windows Defender AV: Configure local setting override for reporting to Microsoft MAPS

This policy setting configures a local override for the configuration to join Microsoft MAPS. This setting can only be set by Group Policy. If you enable this setting, the local preference setting will take priority over Group Policy. If you disable or do not configure this setting, Group Policy...