28 matches found
kernel: Red Hat only CVE-2020-12352 regression
A Red Hat only CVE-2020-12352 regression issue was found in the way the Linux kernel's Bluetooth stack implementation handled the initialization of stack memory when handling certain AMP packets. This flaw allows a remote attacker in an adjacent range to leak small portions of stack memory on the...
Universal Plug and Play (UPnP) SUBSCRIBE can be abused to send traffic to arbitrary destinations
Overview The Universal Plug and Play UPnP protocol in effect prior to April 17, 2020 can be abused to send traffic to arbitrary destinations using the SUBSCRIBE functionality. Description The UPnP protocol, as specified by the Open Connectivity Foundation OCF, is designed to provide automatic...
New DNS Vulnerability Lets Attackers Launch Large-Scale DDoS Attacks
Israeli cybersecurity researchers have disclosed details about a new flaw impacting DNS protocol that can be exploited to launch amplified, large-scale distributed denial-of-service DDoS attacks to takedown targeted websites. Called NXNSAttack, the flaw hinges on the DNS delegation mechanism to...
CVE-2018-19791
The server in LiteSpeed OpenLiteSpeed before 1.5.0 RC6 does not correctly handle requests for byte sequences, allowing an attacker to amplify the response size by requesting the entire response body repeatedly, as demonstrated by an HTTP Range header value beginning with the "bytes=0-,0-" substri...
1.7 Tbps DDoS Attack — Memcached UDP Reflections Set New Record
The bar has been raised. As more amplified attacks were expected following the record-breaking 1.35 Tbps Github DDoS attack, someone has just set a new record after only four days — 1.7 Tbps DDoS attack. Network security and monitoring company Arbor Networks claims that its ATLAS global traffic a...
BitTorrent Patches DDoS Vulnerability
BitTorrent today announced that a patch has been rolled out in the libuTP protocol used by many of its clients, fixing a vulnerability that allows attackers to carry out distributed reflective denial of service attacks. The issue was revealed in a paper and presentation at the recent USENIX...
PT-2013-2155 · Dnsmasq +1 · Dnsmasq +1
Name of the Vulnerable Software and Affected Versions: Dnsmasq versions prior to 2.66test2 Description: The issue allows remote attackers to cause a denial of service, specifically traffic amplification, via spoofed TCP-based DNS queries. This is possible when Dnsmasq is used with certain libvirt...