97 matches found
OSSEC-HIDS Security Audit Findings
Hi folks, I spent some free time recently auditing OSSEC. I w...
CVE-2020-3941
The repair operation of VMware Tools for Windows 10.x.y has a race condition which may allow for privilege escalation in the Virtual Machine where Tools is installed. This vulnerability is not present in VMware Tools 11.x.y since the affected functionality is not present in VMware Tools 11. Recen...
Open Source Host & Endpoint Security: Wazuh
Wazuh is a security detection, visibility, and compliance open source project. It was born as a fork of OSSEC HIDS, later was integrated with Elastic Stack and OpenSCAP evolving into a more comprehensive solution. Wazuh helps you to gain deeper security visibility into your infrastructure by...
Network Security Monitoring: Security Onion
Network Security Monitoring NSM is, put simply, monitoring your network for security related events. It might be proactive, when used to identify vulnerabilities or expiring SSL certificates, or it might be reactive, such as in incident response and network forensics. Whether you’re tracking an...
FreeBSD : security/ossec-hids-* -- root escalation via syscheck feature (c470db07-1098-11e5-b6a8-002590263bf5)
OSSEC reports : The CVE-2015-3222 vulnerability, which allows for root escalation via sys check has been fixed in OSSEC 2.8.2. This issue does not affect agents. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from the...
OSSEC 2.8.1 Local Root Escalation
Fix for CVE-2015-3222 which allows for root escalation via syscheck - https://github.com/ossec/ossec-hids/releases/tag/2.8.2 Affected versions: 2.7 - 2.8.1 Beginning is OSSEC 2.7 d88cf1c9 a feature was added to syscheck, which is the daemon that monitors file changes on a system, called...
OSSEC 2.7 < 2.8.1 - 'diff' Local Privilege Escalation
Fix for CVE-2015-3222 which allows for root escalation via syscheck - https://github.com/ossec/ossec-hids/releases/tag/2.8.2 Affected versions: 2.7 - 2.8.1 Beginning is OSSEC 2.7 d88cf1c9 a feature was added to syscheck, which is the daemon that monitors file changes on a system, called...
Host Based Intrusion Detection System: Samhain
The Samhain host-based intrusion detection system HIDS provides file integrity checking and log file monitoring/analysis, as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes. samhain is a file and host integrity and intrusion alert system...
FreeBSD : security/ossec-hids-* -- root escalation via temp files (36858e78-3963-11e4-ad84-000c29f6ae42)
OSSEC reports : This correction will create the temp file for the hosts deny file in /var/ossec and will use mktemp where available to create NON-predictable temp file name. In cases where mktemp is not available we have written a BAD version of mktemp, but should be a little better then just...
BlueZ 1.x/2.x - HIDD Bluetooh HID Command Injection Vulnerability
No description provided by source. source: http://www.securityfocus.com/bid/22076/info BlueZ hidd is prone to a device-command-injection vulnerability. A remote attacker can exploit this issue to gain control of mouse and keyboard HIDs human interface device. This will allow the attacker to...
[Weevely v1.1] Stealth tiny PHP web shell
Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation , and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones. Weevely is currently included in Backtrack and Backbox...
[SAMHAIN v3.0.11 & BELTANE v2.4.6] Host-based intrusion detection system (HIDS)
The Samhain host-based intrusion detection system HIDS provides file integrity checking and log file monitoring/analysis , as well as rootkit detection, port monitoring, detection of rogue SUID executables, and hidden processes. Samhain been designed to monitor multiple hosts with potentially...
Design/Logic Flaw
TrueVector in Check Point ZoneAlarm 8.0.020.000, with vsmon.exe running, allows remote HTTP proxies to cause a denial of service crash and disable the HIDS module via a crafted response...
CVE-2008-7025
TrueVector in Check Point ZoneAlarm 8.0.020.000, with vsmon.exe running, allows remote HTTP proxies to cause a denial of service crash and disable the HIDS module via a crafted response...
CVE-2008-7025
TrueVector in Check Point ZoneAlarm 8.0.020.000, with vsmon.exe running, allows remote HTTP proxies to cause a denial of service crash and disable the HIDS module via a crafted response...
CVE-2008-7025
CVE-2008-7025 affects Check Point ZoneAlarm 8.0.020.000 when vsmon.exe is running. A crafted HTTP proxy response can cause a denial of service (crash) and disable the HIDS module. The vulnerability is reported across multiple sources (NVD entry and related records). The provided materials do not ...
Crashing ZoneAlarm 8.0.020.000 by Checkpoint (Component : TrueVector)
Crashing ZoneAlarm 8.0.020.000 by Checkpoint Component : TrueVector ========================================== - Keep ZoneALarm 8 running with vsmon.exe running which runs by default - On System A : Run the rogue proxy attached zacrasherproxy.exe and set a port number eg: zacrasherproxy.exe 5938 ...