SA139 : November 2016 NTP Security Vulnerabilities

SUMMARY Symantec Network Protection products using affected versions of the NTP reference implementation from ntp.org are susceptible to multiple vulnerabilities. A remote attacker can modify the targets system time, prevent the target from synchronizing its time, cause denial of service through...

By the MurmurHash2 algorithm, a collision caused by Redis DDos attack vulnerability

Summary information: 1. In Martin Bosslet 2012 this article, The author mentioned the MurmurHash2 algorithm was found to be the stable structure of the collision function, the hash function and its deformation is CRuby, JRuby, Rubinius, Redis, etc. open source components used. 2. This article is...

DirectAdmin 1.50.1 - Denial of Service Vulnerability

Exploit for php platform in category dos / poc Directadmin ControlPanel 1.50.1 denial of service Vulnerability Directadmin Version : 1.50.1 And Old Version Testet On : Centos 6 - Directadmin 1.50.1 Vendor site : http://www.directadmin.com Author : Amir email protected - https://telegram.me/AmirAm...

DirectAdmin 1.50.1 - Denial of Service

@@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@...

DirectAdmin Control Panel 1.50.1 Denial Of Service

@@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@...

DirectAdmin 1.50.1 - Denial of Service

DirectAdmin 1.50.1 - Denial of Service @@@ @@@@@@@@@@@ @@@@@ @@@@@@@@@@ @@@ @@@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@ @@@ @@ @@@ @@ @@@ @@@ @@@ @@@ @@@@@@@@@@@ @@@ @ @@@@@@@@@@ @@@ @@@@@@ @@@ @@@@@@@@@@@ @@@ @@ @@@ @@ @@@ @@@@@@ @@@ @@@ @@@ @@ @@...

FireCrypt Ransomware Contains DDoS Functionality

In addition to encrypting files, a new strain of ransomware also attempts to carry out a DDoS attack, albeit a weak one. The ransomware, FireCrypt, was uncovered by forensic experts at MalwareHunterTeam and analyzed by Bleeping Computer’s Lawrence Abrams on Wednesday. The malware technically come...

Distributed Denial Of Service (DDoS)

botkit is vulnerable to distributed denial of service DDoS attacks. These attacks are possible because it does not validate the X-HUB signature sent in the headers against the facebook app secret. This allows attackers to send arrays with a large amount of data in them to botkit and lock the...

Four New Normals for 2017

Let’s not talk about cybersecurity predictions for 2017. Let’s talk instead about new normals, things that have ceased to be novel because, well, they happen all the time and everywhere. Let’s concede that things such as greedy ransomware, imposing IOT botnets, high-profile bug bounties and...

Hackers threaten to take down Xbox Live and PSN on Christmas Day

Bad news for gamers! It's once again the time when most of you will get new PlayStations and XBoxes that continue to be among the most popular gifts for Christmas, but possibilities are you'll not be able to log into the online gaming console, just like what happens on every Christmas holidays. O...

FreeBSD -- Multiple vulnerabilities of ntp

Problem Description: Multiple vulnerabilities have been discovered in the NTP suite: CVE-2016-9311: Trap crash, Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-9310: Mode 6 unauthenticated trap information disclosure and DDoS vector. Reported by Matthew Van Gundy of Cisco ASIG. CVE-2016-742...

SUSE-SU-2016:3195-1 Security update for ntp

This update for ntp fixes the following issues: ntp was updated to 4.2.8p9. Security issues fixed: - CVE-2016-9311, CVE-2016-9310, bsc1011377: Mode 6 unauthenticated trap information disclosure and DDoS vector. - CVE-2016-7427, bsc1011390: Broadcast Mode Replay Prevention DoS. - CVE-2016-7428,...

X (Formerly Twitter): Remote Unrestricted file Creation/Deletion and Possible RCE.

Hello Gents, During my research on Twitter BBP, I found below domain name: Reverb.twitter.com Background: We worked with Twitter to develop TwitterReverb, an application that reveals how conversations arise and reverberate across the entire Twitter landscape. The custom application allows visitor...

On Yahoo's One Billion Breach, a DDoS-For-Hire Crackdown and More

Mike Mimoso and Chris Brook discuss the news of the week including Yahoo’s latest breach announcement, a DDoS-for-hire crackdown, hackers seeking help with Mirai, and some new Adobe patches. Show notes: Yahoo Discloses Data From 1 Billion Accounts Stolen in 2013 Beta Firmware Updates Available fo...

Mirai Giving DDoS-as-a-Service Industry a Boost

The availability of the Mirai malware source code online isn’t a guarantee that just anyone can quickly convert it into a money-making IoT-based DDoS botnet. Researchers at Digital Shadows have been combing dark web sites such as the Hackforums where black hat Anna-Senpai dropped the Mirai code i...

Law Enforcement Targets Users of DDoS-For-Hire Services

Law enforcement authorities from more than a dozen countries last week carried out a series of operations designed to crack down on DDoS-for-hire services. Thirty four individuals who are alleged to have purchased stressers and booter services were arrested as part of the operation. Stressers and...

Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS Vulnerabilities

Exploit for macOS platform in category dos / poc Apple macOS 10.12.1/iOS 10 SecureTransport SSL handshake OCSP MiTM and DoS Credit: Maksymilian Arciemowicz https://cxsecurity.com/ --- 0. Description ---- The latest macOS and iOS have weak OCSP validation process which allow attacker to send OCSP...

Europol arrests 34 Teenagers for using DDoS Attack Tools

Europol has announced that the law enforcement agencies from 13 countries around the globe have arrested 34 users of Netspoof DDoS attack tool and interviewed and warned 101 suspects in a global crackdown. According to the report published on the official website of Europol, law enforcement...

On Backdoors in Sony's IP Cameras, a Linux Bug, and More

Mike Mimoso and Chris Brook discuss the news of the week, including the latest Linux bug, Sony closing backdoors in cameras, and Google’s new open source fuzzer. Show notes: Sony Closes Backdoors in IP-Enabled Cameras Old Linux Kernel Code Execution Bug Patched Google Debuts Continuous Fuzzer for...

New Call to Regulate IoT Security By Design

A Washington, D.C. think tank whose mission is critical infrastructure security has joined the call for lawmakers to consider regulating the security of connected devices. In a report published this week, the Institute for Critical Infrastructure Technology pinned the blame for a rash of Mirai...