CVE-2017-9811: Improper Input Validation

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. By abusing the quarantine read and write operations, it is possible to elevate the privileges to root...

Kaspersky Anti-Virus for Linux File Server Path Traversal Vulnerability

Kaspersky Anti-Virus for Linux File Server is designed to provide antivirus protection for file servers running under the Linux operating system. A path traversal vulnerability exists in Kaspersky Anti-Virus for Linux File Server. The vulnerability allows an attacker to read arbitrary files with...

Kaspersky Anti-Virus for Linux File Server Reflective Cross-Site Scripting Vulnerability

Kaspersky Anti-Virus for Linux File Server is designed to provide antivirus protection for file servers running under the Linux operating system. A reflected cross-site scripting vulnerability exists in Kaspersky Anti-Virus for Linux File Server. The vulnerability allows an attacker to execute...

Kaspersky Anti-Virus for Linux File Server Cross-Site Request Forgery Vulnerability

Kaspersky Anti-Virus for Linux File Server is designed to provide antivirus protection for file servers running under the Linux operating system. A cross-site request forgery vulnerability exists in Kaspersky Anti-Virus for Linux File Server. This allows an attacker to submit authenticated reques...

Kaspersky Anti-Virus for Linux File Server Elevation of Privilege Vulnerability

Kaspersky Anti-Virus for Linux File Server is designed to provide antivirus protection for file servers running under the Linux operating system. An elevation of privilege vulnerability exists in Kaspersky Anti-Virus for Linux File Server. The vulnerability allows attackers to exploit an elevatio...

Kaspersky Anti-Virus File Server 8.0.3.297 XSS / CSRF / Code Execution

Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Advisory URL: http://www.coresecurity.com/advisories/Kaspersky-Anti-Virus-File-Server-Multiple-Vulnerabilities Date published: 2017-06-28 Date of last update: 2017-06-28 Vendors...

Kaspersky Anti-Virus File Server Multiple Vulnerabilities

Advisory ID Internal CORE-2017-0003 1. Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Date published: 2017-06-28 Date of last update: 2017-06-28 Vendors contacted: Kaspersky Release mode: Forced release 2. Vulnerability...

Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities

Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Advisory URL: http://www.coresecurity.com/advisories/Kaspersky-Anti-Virus-File-Server-Multiple-Vulnerabilities Date published: 2017-06-28 Date of last update: 2017-06-28 Vendors...

The vulnerability in the web console of the Antivirus Kasper’s 8.0 anti-virus software for Linux File Servers allows access to files located on the server.

The vulnerability of the Antivirus Kaspersky 8.0 web console for Linux File Servers relates to the possibility of executing operating system commands. Exploiting this vulnerability allows a malicious actor to gain access to files located on the server by sending a specially crafted GET request wi...

WikiLeaks Dumps CIA Patient Zero Windows Implant

WikiLeaks on Thursday made public a CIA implant that is used to turn a Windows file server into a malware distribution point on the local network. The documents describing the tool, Pandemic, explain how remote machines on the local network trying to download and-or execute documents from the fil...

May 9, 2017—KB4019216 (Monthly Rollup)

None None...

PT-2017-2933

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue is related to the absence of Anti-CSRF tokens in all forms on the web interface of Kaspersky Anti-Virus for Linux File Server. This could allow a remo...

PT-2017-2932

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue is related to the reportId parameter of the getReportStatus action method in the web interface, which can be exploited to read arbitrary files with...

PT-2017-2895

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue concerns a cross-site scripting XSS vulnerability related to the scriptName parameter of the licenseKeyInfo action method. This vulnerability can be...

PT-2017-2844

Name of the Vulnerable Software and Affected Versions Kaspersky Anti-Virus for Linux File Server versions prior to 8.0.4.312 Description The issue exists due to insufficient input validation during quarantine read and write operations in the kav4fs-control service. This can be exploited by a remo...

Analysis of Kerberos constrained delegation SPN security vulnerabilities-vulnerability warning-the black bar safety net

In the past few years, more and more security researchers began to study Kerberos security, eventually found in support of the authentication Protocol of the network environment a lot of interesting attacks. In this post, I will describe my in the Windows Kerberos constrained delegation feature...

March 14, 2017—KB4012606 (OS Build 10240.17319)

None None...

CVE-2017-6100

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

June 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2

June 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 This update rollup is superseded by July 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 KB3172614 that was released on July 21, 2016. The June 2016 update rollup for Windows RT 8.1,...

CVE-2016-4025

Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email...