SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:2243-1)

This update for freeradius fixes the following issues: Security issues fixed : - CVE-2017-10988: Decode 'signed' attributes correctly. bnc1049086 - CVE-2017-10987: Check for option overflowing the packet. bnc1049086 - CVE-2017-10985: Fix infinite loop and memory exhaustion with 'concat' attribute...

Juniper Junos snmpd SNMP Packet Handling RCE (JSA10793)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a remote code execution vulnerability in the snmpd daemon due to improper handling of SNMP packets. An unauthenticated, remote attacker can exploit this, via a specially crafted SNMP...

Juniper Junos rpd MPLS Ping Packet Handling DoS (JSA10795)

According to its self-reported version number and configuration, the remote Juniper Junos device is affected by a denial of service vulnerability in the rpd daemon due to improper handling of MPLS ping packets. An unauthenticated, remote attacker can exploit this, via a specially crafted MPLS pin...

Debian DLA-1063-1 : extplorer security update

CVE-2017-12756 Fix command inject in transfer from another server in extplorer 2.1.9 and prior allows attacker to inject command via the userfile0 parameter. For Debian 7 'Wheezy', these problems have been fixed in version 2.1.0b6+dfsg.3-4+deb7u5. We recommend that you upgrade your extplorer...

Fedora 26 : bodhi (2017-48f0384090)

Update to 2.9.1, which addresses CVE-2017-1002152. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

Unspecified vulnerability in Google Android Qualcomm component (CNVD-2017-27869)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA in the U.S. Qualcomm is one of the Qualcomm components used in Qualcomm devices. An unspecified vulnerability exists in the Google Android Qualcomm component, where the UE may send...

Threat Analysis: Carbon Black Threat Research Dissects PNG Dropper

UPDATE 8/14/17: After posting the original analysis, the Carbon Black Threat Research team received numerous requests for the tools to extract the second stage payload from the initial PNGdropper file. As a result, the source code and compiled binaries are being made public and are posted to the...

Design/Logic Flaw

In all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send IMEI or IMEISV to the network on a network request before NAS security has been activated...

CVE-2015-1817

Stack-based buffer overflow in the inetpton function in network/inetpton.c in musl libc 0.9.15 through 1.0.4, and 1.1.0 through 1.1.7 allows attackers to have unspecified impact via unknown vectors...

SUSE SLES12 Security Update : freeradius-server (SUSE-SU-2017:2202-1)

This update for freeradius-server fixes the following issues : - update to 3.0.15 bsc1049086 - Bind the lifetime of program name and python path to the module - CVE-2017-10978: FR-GV-201: Check input / output length in makesecret bsc1049086 - CVE-2017-10983: FR-GV-206: Fix read overflow when...

The vulnerability of the Network Security Services library allows a perpetrator to cause a service failure or exert other effects.

The vulnerability of the Network Security Services library lies in the writing beyond the buffer boundaries in memory. This vulnerability arises due to incorrect decoding of Base64-encoded data. Exploiting this vulnerability can allow a malicious actor to cause service failures or other effects b...

SUSE SLED12 / SLES12 Security Update : java-1_8_0-openjdk (SUSE-SU-2017:2175-1)

This java-180-openjdk update to version jdk8u141 icedtea 3.5.0 fixes the following issues: Security issues fixed : - CVE-2017-10053: Improved image post-processing steps bsc1049305 - CVE-2017-10067: Additional jar validation steps bsc1049306 - CVE-2017-10074: Image conversion improvements...

SweetSecurity - Network Security Monitoring on Raspberry Pi type devices

Scripts to setup and install Bro IDS, Elasticsearch, Logstash, Kibana, and Critical Stack on any device. Getting Sweet Security Either download the Github repository manually, or clone the repo with the following command: $ git clone https://github.com/travisfsmith/sweetsecurity Prerequisites Mos...

Legal Robot: Futureoflife organization URL should be HTTPS

SUMMARY This is just for the awareness to use HTTPS everywhere, even for outgoing links - where it's possible. Treat this report with some salt, not as in hashes. Navigate to: https://www.legalrobot-uat.com/faq/ futureoflife organization URL redirect to HTTPS after click, but cookie is sent on th...

Mozilla Network Security Services heap buffer overflow vulnerability (CNVD-2017-27972)

Network Security Services is a library of functions Network Security Services Library that provides cross-platform support for SSL, S/MIME and other Internet security standards. A buffer overflow vulnerability exists in hashopen in the Network Security Services file lib/dbm/src/hash.c, which allo...

Mozilla Network Security Services heap buffer overflow vulnerability (CNVD-2017-27970)

Mozilla Network Security Services is a library that provides cross-platform support for SSL, S/MIME and other Internet security standards. A buffer overflow vulnerability exists in getpage in the Network Security Services file lib/dbm/src/hpage.c, which allows an attacker to execute arbitrary cod...

Mozilla Network Security Services heap buffer overflow vulnerability (CNVD-2017-27971)

Mozilla Network Security Services is a library that provides cross-platform support for SSL, S/MIME and other Internet security standards. A buffer overflow vulnerability exists in hashopen in the Network Security Services file hash.c, which allows an attacker to execute arbitrary code, failure o...

Mozilla Network Security Services Heap Buffer Overflow Vulnerability

Mozilla Network Security Services is a library that provides cross-platform support for SSL, S/MIME and other Internet security standards. A buffer overflow vulnerability exists in allocsegs in the Network Security Services file lib/dbm/src/hash.c, which allows an attacker to execute arbitrary...

Legal Robot: observer.com URL should HTTPS

Summary This is just for the awareness to use HTTPS everywhere, even for outgoing links - where it's possible. Treat this report with some salt, not as in hashes. Navigate to: https://www.legalrobot-uat.com/press/ Example page In the lower part where you find the observer.com Link: observer...

Kick Devices Off Your Network: KickThemOut

A tool to kick devices out of your network and enjoy all the bandwidth for yourself. It allows you to select specific or all devices and ARP spoofs them off your local area network. KickThemOut ARP Spoofs devices in your Local Area Network killing their internet connectivity and therefore allowin...