U.S. Dept Of Defense: Previously Compromised PulseSSL VPN Hosts

Hi again!! Back in 2019, I had reported that a pulseSSL VPN server owned by US DoD can be compromised by a publicly available exploit. The report is 681249. As a result, the userid and passwd db was also compromised. I found that at least 1 userid and password combination from that compromised db...

CVE-2019-6203

CVE-2019-6203 affects Apple devices via the 802.1X component, where a logic/state-management issue could allow a privileged network-position attacker to intercept traffic. Apple’s security pages tie this to iOS 12.2, macOS Mojave 10.14.4, and tvOS 12.2, with fixes in those releases. The CVE is do...

CVE-2020-11868

NTOP vulnerability CVE-2020-11868 affects ntp in ntp (before 4.2.8p14 and 4.3.x before 4.3.100). An off-path attacker can block unauthenticated synchronization by sending a server-mode packet with a spoofed source IP, because transmissions can be rescheduled even when the origin timestamp is inva...

Design/Logic Flaw

An issue was found in Arista EOS. Specific malformed ARP packets can impact the software forwarding of VxLAN packets. This issue is found in Arista’s EOS VxLAN code, which can allow attackers to crash the VxlanSwFwd agent. This affects EOS 4.21.8M and below releases in the 4.21.x train, 4.22.3M a...

Security guidance for remote desktop adoption

As the volume of remote workers quickly increased over the past two to three months, the IT teams in many companies scrambled to figure out how their infrastructures and technologies would be able to handle the increase in remote connections. Many companies were forced to enhance their capabiliti...

EulerOS Virtualization 3.0.2.2 : libX11 (EulerOS-SA-2020-1471)

According to the versions of the libX11 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - An issue was discovered in XListExtensions in ListExt.c in libX11 through 1.6.5. A malicious server can send a reply in which the...

EulerOS Virtualization 3.0.2.2 : krb5 (EulerOS-SA-2020-1467)

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Double free vulnerability in MIT Kerberos 5 aka krb5 allows attackers to have unspecified impact via vectors involving automatic...

Fedora 30 : kernel / kernel-headers / kernel-tools (2020-73c00eda1c)

The 5.5.16 stable kernel update contains a number of important fixes across the tree. ---- The 5.5.15 stable kernel update contains a number of important fixes across the tree. ---- The 5.5.13 stable kernel update contains a number of important fixes across the tree. ---- The 5.5.11 stable kernel...

Fedora 31 : cacti / cacti-spine (2020-c1745db1aa)

Update to 1.2.11 Release notes: https://www.cacti.net/releasenotes.php?version=1.2.11 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 31 : golang-github-buger-jsonparser (2020-97e8a67945)

Multiple bug fixes, including a fix for CVE-2020-10675 . Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional...

EulerOS Virtualization 3.0.2.2 : libgcrypt (EulerOS-SA-2020-1498)

According to the versions of the libgcrypt package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext...

CVE-2020-2956

CVE-2020-2956 affects Oracle E-Business Suite Human Resources, Hierarchy Diagrammers (and related Hierarchy Viewer components). Connected advisories describe an SQL injection/unsafe input handling in the Position Hierarchy Viewer and Organization Hierarchy Viewer that can lead to unauthorized dat...

CVE-2020-2920

The CVE-2020-2920 entry concerns Oracle Agile PLM (Security component) in Oracle Supply Chain. Affected versions are 9.3.3, 9.3.5, and 9.3.6. The vulnerability allows an unauthenticated attacker with network access via HTTP to compromise Oracle Agile PLM, with impact including unauthorized read a...

CVE-2020-2879

CVE-2020-2879 affects Oracle E-Business Suite, Oracle Scripting (component: Miscellaneous). Affected are versions 12.1.1–12.1.3 and 12.2.3–12.2.9. The vulnerability allows an unauthenticated, network-accessible attacker over HTTP to compromise Oracle Scripting, potentially leading to unauthorized...

CVE-2020-2800

CVE-2020-2800 affects Oracle Java SE/Java SE Embedded, specifically the Lightweight HTTP Server component. Affected versions include Java SE 7u251, 8u241, 11.0.6, 14 and Java SE Embedded 8u241. The vulnerability can be exploited over a network with unauthenticated access via multiple protocols, p...

CVE-2020-2734

CVE-2020-2734 affects Oracle Database Server, specifically the RDBMS/Optimizer component. Affected versions are 12.1.0.2, 12.2.0.1, 18c, and 19c. The vulnerability can be exploited by a highly privileged attacker who has Execute on the DBMS_SQLTUNE privilege and network access via Oracle Net. Exp...

Monitoring and Maintaining Trend Micro Home Network Security – Part 4: Best Practices

We continue our four-part series on protecting your home and family. See the links to the previous parts at the end of this blog. We’re now done with familiarizing ourselves with the features of Trend Micro Home Network Security HNS It’s now time for you to get a bit more adept at regular...

EulerOS 2.0 SP3 : libssh2 (EulerOS-SA-2020-1405)

According to the version of the libssh2 package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found with the libssh API function sshscpnew in versions before 0.9.3 and before 0.8.8. When the libssh SCP client connects to a server,...

EulerOS 2.0 SP3 : giflib (EulerOS-SA-2020-1385)

According to the version of the giflib package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - In GIFLIB before 2019-02-16, a malformed GIF file triggers a divide-by-zero exception in the decoder function DGifSlurp in dgiflib.c if the height...

CVE-2020-7574

Siemens Climatix POL908 (BACnet/IP module) and POL909 (AWM module) are affected by CVE-2020-7574, a cross-site scripting (XSS) vulnerability in the Server Config web interface. The issue, present in all versions for POL908 and all versions