CVE-2023-3665

A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code...

CVE-2023-3665

CVE-2023-3665 concerns a code injection flaw in Trellix Endpoint Security (ENS) up to version 10.7.0. The root cause is that a local attacker can set environment variables to disable the AMSI component, resulting in denial of service and potential arbitrary code execution. The materials confirm a...

CVE-2023-3665

A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code...

CVE-2023-3665: Improper Neutralization of Special Elements in Output Used by a Downstream Component

A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code...

PT-2023-25653 · Trellix · Trellix Ens

Name of the Vulnerable Software and Affected Versions: Trellix ENS versions 10.7.0 and earlier Description: A code injection issue allows a local user to disable the ENS AMSI component via environment variables, leading to denial of service and or the execution of arbitrary code. Recommendations:...

Malicious code in web3tool-eth-ens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f519c2e49729df67c6bf4c20af192d98f35adf19e6be605e44a81b902e127762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8083 Malicious code in web3tool-eth-ens (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f519c2e49729df67c6bf4c20af192d98f35adf19e6be605e44a81b902e127762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in web3tool-eth-ens

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2023-38698

Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...

Integer overflow

Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...

CVE-2023-38698 .eth registrar controller can shorten the duration of registered names

Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...

CVE-2023-38698

Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...

CVE-2023-38698 .eth registrar controller can shorten the duration of registered names

Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...

CVE-2023-38698

The CVE-2023-38698 issue is a vulnerability in ENS:BaseRegistrarImplementation prior to 0.0.22 where an integer overflow in the renew function can be exploited by an attacker-controlled controller to shorten the expiration of a registrar name. The effect is that expiries[id] may overflow, allowin...

CVE-2023-38698: Integer Overflow or Wraparound

Ethereum Name Service ENS is a distributed, open, and extensible naming system based on the Ethereum blockchain. According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration...

Force Expiration Of Ethereum Name Service (ENS)

@ensdomains/ens-contracts is vulnerable to Force Expiration Of Ethereum Name Service ENS. The vulnerability exists due to the integer overflow in the renew function of BaseRegistrarImplementation.sol, which allows an attacker to reduce the expiration time of existing domains...

@ansdomain/react-ans-address (>=0.0.31, <=0.0.32), @ansdomain/ui (>=3.8.0, <=3.8.771) +93 more potentially affected by CVE-2023-38698 via @ensdomains/ens-contracts (>=0.0.2, <=0.0.21)

@ensdomains/ens-contracts NPM version =0.0.2, =0.0.31, =3.8.0, =0.3.0-alpha, =1.2.0, =0.0.1, =0.0.1, =2.1.7, =3.4.2, =0.0.1, =3.4.5, =3.0.0-alpha.3, =2.2.2, =1.0.0, =1.0.0, =2.1.0 and more Source cves: CVE-2023-38698 Source advisory: OSV:GHSA-RRXV-Q8M4-WCH3...

.eth registrar controller can shorten the duration of registered names

Description According to the documentation, controllers are allowed to register new domains and extend the expiry of existing domains, but they cannot change the ownership or reduce the expiration time of existing domains. However, a preliminary analysis suggests that an attacker-controlled...

PT-2023-26562

Name of the Vulnerable Software and Affected Versions Ethereum Name Service ENS versions prior to 0.0.22 Description The issue is related to an integer overflow in the renew function, which could allow an attacker-controlled controller to reduce the expiration time of existing domains. This could...

Claiming of domains will likely be locked due to a bad check in _enableNode

Lines of code Vulnerability details Description DNS name claims all go through claim which calls enableNode, which calls enableNode. Nodes are enabled recursively, from the root downwards.The following check occurs in enableNode: node = keccak256abi.encodePackedparentNode, label; address owner =...