Necurs Rootkit infect 83,427 machines in November

Rootkit named as "Necurs" infect 83,427 unique machines during the month of November 2012. It is a multi-purpose rootkits capable of posing a threat to both 32 and 64-bit Windows systems. Distributed via drive-by download on the websites that host the BlackHole exploit kit. Like other rootkits it...

Necurs Rootkit infect 83,427 machines in November

Rootkit named as "Necurs" infect 83,427 unique machines during the month of November 2012. It is a multi-purpose rootkits capable of posing a threat to both 32 and 64-bit Windows systems. Distributed via drive-by download on the websites that host the BlackHole exploit kit. Like other rootkits it...

Samsung / Dell Printer SNMP Backdoor

Binary data 6639.prm...

Symantec Messaging Gateway 9.5.3-3 - Cross-Site Request Forgery

Symantec Messaging Gateway 9.5.3-3 - Cross-Site Request Forgery ======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams Vendor: Symantec Vendor Reference: Systems...

Symantec Messaging Gateway 9.5.3-3 - Cross-Site Request Forgery

======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway 9.5.3-3 Risk: High Status:...

Symantec Messaging Gateway 9.5.3-3 CSRF Vulnerability

Symantec Messaging Gateway version 9.5.3-3 suffers from a cross site request forgery vulnerability. ======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams Vendor:...

Samsung / Dell Printer SNMP Backdoor

The remote host appears to be a Samsung printer, or a Dell printer manufactured by Samsung. It has a hard-coded SNMP read-write community string that allows access even when SNMP has been disabled in the printer management utility. A remote, unauthenticated attacker can exploit this to take contr...

NGS000267 Technical Advisory: Symantec Messaging Gateway SSH with backdoor user account plus privilege escalation to root due to very old Kernel

======= Summary ======= Name: Symantec Messaging Gateway - SSH with backdoor user account + privilege escalation to root due to very old Kernel Release Date: 30 November 2012 Reference: NGS00267 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems Affecte...

NGS000263 Technical Advisory: Symantec Messaging Gateway Easy CSRF to add a backdoor-administrator

======= Summary ======= Name: Symantec Messaging Gateway - Easy CSRF to add a backdoor-administrator for example Release Date: 30 November 2012 Reference: NGS00263 Discoverer: Ben Williams [email protected] Vendor: Symantec Vendor Reference: Systems Affected: Symantec Messaging Gateway...

Samsung 打印机固件管理账号后门

BUGTRAQ ID: 56692 CVECAN ID: CVE-2012-4964 Samsung是韩国三星电子，成立于1969年。 Samsung打印机及某些三星产的Dell打印机包含硬编码的完全读写权限的SNMP community string，即使在打印机管理程序中禁用SNMP，此字符串也是有效的，导致远程攻击者可完全控制受影响设备。2012年10月31日后的发布的模块不受此漏洞的影响。 利用该漏洞，一个远端的未授权的攻击者可以1 以管理权限访问受影响设备 （2）修改受影响设备的配置、访问敏感资源 （3） 代码执行 有报告称已有发布工具利用该漏洞。 0 Samsung...

Phony T-Mobile, Vodaphone Notifications Duping U.K. Users

Cybercriminals in the United Kingdom this week have launched two separate but similar scams intent on gaining access to users’ computers. Both scams impersonate e-mail notifications from popular British cell phone companies and both ultimately open a backdoor on the targeted computers. E-mail...

Piwik Update Infected with Backdoor Malware

Attackers infiltrated a webserver belonging to the open source Piwik website analytics project and injected backdoor malware into a zip file update on Monday. Users who downloaded the Piwik update 1.9.2 between 15:43 UTC to 23:59 UTC are urged to check piwik/core/Loader.php file for the following...

Samsung printer having secret admin account Backdoor

US CERT warn about Some Samsung printers, including models the Korean company made for Dell, have a backdoor administrator account coded into their firmware. This hard coded admin account in firmware could enable attackers to change their configuration, read their network information or stored...

Piwik core/Loader.php Trojaned Distribution

The version of Piwik installed on the remote web server contains a trojaned backdoor, and allows the execution of arbitrary PHP code subject to the privileges under which the web server operates. It is likely to have been installed from a copy of the file 'latest.zip' downloaded from the project'...

Backdoor in Piwik analytics software

A backdoor has been added to the web server analytics Piwik which allows attackers to take control of a system. SPDX-FileCopyrightText: 2012 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

D-Link DSR-250N Persistent Root Access

D-Link DSR-250N has a backdoor account that allows for persistent root access. D-Link DSR-250N Persistent Root Access Router: D-Link DSR-250N Hardware Version: A1 Firmware Version: 1.05B73WW Arch: armv6l, Linux Author: 0o -- nullnull nu11.nu11 at yahoo.com Date: 2012-11-25 Purpose: Persistently...

Linux Kernel 2.6.x /proc Rootkit Backdoor (Unix/Darbe-A)

Linux Kernel 2.6.x /proc rootkitUnix/Darbe-A Date: ===== 2012-11-21 Introduction: ============= Unix/Darbe-A is a new kernel rootkit based /proc file system., modification is made in order to support kernel 2.6.x Detected ========...

Multiple Command Execution Vulnerabilities in Smartphone Pentest Framework (SPF)

High-Tech Bridge Security Research Lab discovered multiple command execution vulnerabilities in Smartphone Pentest Framework SPF web-based GUI, which could be exploited to get control over a pentester's machine remotely. Similar vulnerabilities were discovered...

eliteCMS installation file did not validate + the word written to the security vulnerability-vulnerability warning-the black bar safety net

eliteCMS installation program after the installation is not locked, cause hackers can access setup addresses repeat the installation 另外 一 个 漏洞 是 安装 程序 可以 直接 写 入 一句话 到 admin/includes/config.php We look at the code: ... elseif $GET'step' == "4" $file = "../admin/includes/config.php"; $write = "?...

SAP NetWeaver DI - Arbitrary file upload

Application: SAP NetWeaver J2EE Versions Affected: SAP NetWeaver Vendor URL: http://www.sap.com Bugs: Arbitrary file upload/Security bypass Exploits: YES Reported: 11.12.2012 Vendor response: 12.12.2012 Date of SAP Security Note Published: 12.02.2013 Date of Public Advisory: 20.02.2013 Reference:...