cve-2022-26809

CVE-2022-26809 检测针对 CVE-2022-26809 的尝试和成功利用，这是一个通过DCE/RPC的远程代码执行漏洞。此包在这篇Corelight博客文章中有详细描述。此包生成以下通知： CVE202226809::ExploitAttempt CVE202226809::ExploitSuccess 第一个在攻击尝试时生成，但不一定成功。第二个仅在检测到成功利用时触发，应立即进行调查。不会生成新的日志。此包可以使用zkg通过以下命令安装： root@kitploit: $ zkg refresh $ zkg install cve-2022-26809...

CVE-2021-1675

PrintNightmare CVE-2021-1675 このZeekスクリプトは、脆弱性の悪用に必要な RpcAddPrinterDriver,Ex DCE RPC イベントの成功を検出します。テストは Lares Lab のエクスプロイトPCAPに基づいています。Zeekバージョン 3.0.2 および 4.0.1 でテスト済みです。 通知 PrinterDriverChangedSuccessfully は、プリンタードライバーが正常に変更されたことを示します。 Suricata また、このエクスプロイトで使用されるDCE RPCコマンドを検出するための Suricataルール...

OPENSUSE-SU-2026:21540-1 Security update for samba

This update for samba fixes the following issues: Update to 4.22.11. Security issues fixed: - CVE-2026-1933: missing access check on reparse point operations allows unauthorized users to modify the user.SmbReparse xattr bsc1261188. - CVE-2026-2340: WORM vfs module does not block directory...

PT-2026-43436

Name of the Vulnerable Software and Affected Versions Samba affected versions not specified Description A flaw exists in the handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users who possess underlying filesyst...

Wireshark 2.0.x < 2.0.8 Multiple Vulnerabilities (macOS)

The version of Wireshark installed on the remote macOS / Mac OS X host is prior to 2.0.8. It is, therefore, affected by multiple vulnerabilities as referenced in the wireshark-2.0.8 advisory. - In Wireshark 2.2.0 to 2.2.1 and 2.0.0 to 2.0.7, the OpenFlow dissector could crash with memory...

Cisco IOS XE Software Unified Threat Defense Snort Intrusion Prevention System Engine Multiple Vulnerabilities (cisco-sa-snort3-dcerpc-vulns-J9HNF4tH)

According to its self-reported version, Cisco IOS-XE Software is affected by the following vulnerabilities: - A vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restar...

Cisco Firepower Threat Defense (FTD) Software Multiple Vulnerabilities (cisco-sa-snort3-dcerpc-vulns-J9HNF4tH)

According to its self-reported version, Cisco Secure Firewall Threat Defense FTD Software is affected by the following vulnerabilities: - A vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak...

CVE-2026-20026 Multiple Cisco Products Snort 3 DCERPC Vulnerabilities

Multiple Cisco products are affected by a vulnerability in the processing of DCE/RPC requests that could allow an unauthenticated, remote attacker to cause the Snort 3 Detection Engine to leak sensitive information or to restart, resulting in an interruption of packet inspection. This vulnerabili...

PT-2026-2047

Name of the Vulnerable Software and Affected Versions Cisco products affected versions not specified Description A flaw exists in the processing of DCE/RPC requests that may allow a remote attacker to obtain sensitive information or cause the Snort 3 Detection Engine to restart, leading to an...

EUVD-2013-4287

Malware in sbrugna...

EUVD-2021-27014

Malware in sbrugna...

EUVD-2021-10299

Malware in sbrugna...

CVE-2019-19707

On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices with firmware through 6.0, denial of service can occur via PROFINET DCE-RPC endpoint discovery packets...

VMware Releases vCenter Server Update to Fix Critical RCE Vulnerability

VMware has released software updates to address an already patched security flaw in vCenter Server that could pave the way for remote code execution. The vulnerability, tracked as CVE-2024-38812 CVSS score: 9.8, concerns a case of heap-overflow vulnerability in the implementation of the DCE/RPC...

In DCE/RPC it is possible to share the handles (cookies for resource state) between multiple connections via a mechanism called 'association groups'. These handles can reference connections to our sam.ldb database. However while the database was correctly shared the user credentials state was only pointed at and when one connection within that association group ended the database would be left pointing at an invalid 'struct session_info'. The most likely outcome here is a crash but it is possible that the use-after-free could instead allow different user state to be pointed at and this might allow more privileged access.

...

Patch Issued for Critical VMware vCenter Flaw Allowing Remote Code Execution

Broadcom on Tuesday released updates to address a critical security flaw impacting VMware vCenter Server that could pave the way for remote code execution. The vulnerability, tracked as CVE-2024-38812 CVSS score: 9.8, has been described as a heap-overflow vulnerability in the DCE/RPC protocol. "A...

Advisory ROSA-SA-2024-2451

Software: samba 4.12.3 OS: ROSA Virtualization 2.1 packageevrstring: samba-4.12.3 CVE-ID: CVE-2020-25722 BDU-ID: 2022-00004 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the Active Directory Domain Controller component of the Samba networking software package is caused by a buffer overflow...

VMware Issues Patches for Cloud Foundation, vCenter Server, and vSphere ESXi

VMware has released updates to address critical flaws impacting Cloud Foundation, vCenter Server, and vSphere ESXi that could be exploited to achieve privilege escalation and remote code execution. The list of vulnerabilities is as follows - CVE-2024-37079 & CVE-2024-37080 CVSS scores: 9.8 -...

EulerOS Virtualization 2.11.1 : samba (EulerOS-SA-2024-1408)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when...

RHEL 8 : samba (RHSA-2023:7464)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:7464 advisory. Samba is an open-source implementation of the Server Message Block SMB protocol and the related Common Internet File System CIFS protocol,...