Cybersecurity and Class M Planets

I was considering another debate about appropriate cybersecurity measures and I had the following thought: not all networks are the same. Profound, right? This is so obvious, yet so obviously forgotten. Too often when confronting a proposed defensive measure, an audience approaches the concept fr...

Microsoft Windows 10 Version 1607 Unsupported Version Detection (deprecated)

This plugin has been replaced by Windows Security-End-of-Life plugins. C Tenable Network Security, Inc. @DEPRECATED@ Deprecated on 2024 Mar 14. Replaced by Windows SEoL plugins. include"compat.inc"; if description scriptid118715; scriptversion"1.12";...

Fedora 27 : sos-collector (2018-f2f8571abd)

Update to new 1.5 release. Resolves CVE-2018-14650 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

AVEVA InduSoft Web Studio and InTouch Edge HMI (formerly InTouch Machine Edition)

1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: AVEVA Software, LLC. AVEVA Equipment: InduSoft Web Studio and InTouch Edge HMI formerly InTouch Machine Edition Vulnerabilities: Stack-based Buffer Overflow, Empty Password in Configuration File 2...

RHEL 7 : krb5 (RHSA-2018:3071)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:3071 advisory. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending...

SUSE SLED12 / SLES12 Security Update : Test-update for SLE-12-SP4 (security) (SUSE-SU-2018:3556-1)

This is a security test-update for SLE-12-SP4. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable...

Hardcoded credentials

An issue was discovered on EE 4GEE HH70VB-2BE8GB3 HH70E102.0019 devices. Hardcoded root SSH credentials were discovered to be stored within the "coreapp" binary utilised by the EE router for networking services. An attacker with knowledge of the default password oelinux123 could login to the rout...

NetworkManager: Information exposure in DNS resolver

An information exposure vulnerability has been found in NetworkManager when dnsmasq is used in DNS processing mode. An attacker in control of a DNS server could receive DNS queries even though a Virtual Private Network VPN was configured on the vulnerable machine...

SUSE SLED12 / SLES12 Security Update : lcms2 (SUSE-SU-2018:3545-1)

This update for lcms2 fixes the following security issues : CVE-2016-10165: The TypeMLURead function allowed remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted ICC profile, which triggered an out-of-bounds heap read bsc1021364. CVE-2018-16435...

SUSE SLES11 Security Update : mysql (SUSE-SU-2018:3542-1)

MySQL server was updated to version 5.5.62, fixing bugs and security issues. Changes : http://dev.mysql.com/doc/relnotes/mysql/5.5/en/news-5-5-62.html Following security issues were fixed : CVE-2016-9843: The crc32big function in zlib might have allowed context-dependent attackers to have...

SUSE SLES11 Security Update : openssh (SUSE-SU-2018:3540-1)

This update for openssh fixes the following issues : Security issues fixed : CVE-2018-15919: Remotely observable behaviour in auth-gss2.c in OpenSSH could be used by remote attackers to detect existence of users on a target system when GSS2 is in use. OpenSSH developers do not want to treat such ...

Debian DLA-1556-1 : paramiko security update

CVE-2018-1000805 Fix to prevent malicious clients to trick the Paramiko server into thinking an unauthenticated client is authenticated. CVE-2018-7750 Fix check whether authentication is completed before processing other requests. A customized SSH client can simply skip the authentication step. F...

EulerOS Virtualization 2.5.2 : kernel (EulerOS-SA-2018-1351)

According to the version of the kernel packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - An integer overflow flaw was found in the Linux kernel's createelftables function. An unprivileged local user with access to SUID or...

EulerOS Virtualization 2.5.0 : kvm (EulerOS-SA-2018-1350)

According to the version of the kvm package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability : - Modern operating systems implement virtualization of physical memory to efficiently use available system resources and provide...

Fedora 27 : python26 (2018-14526cbebe)

Security fix for CVE-2018-14647 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 7030...

Have Network, Need Network Security Monitoring

I have been associated with network security monitoring my entire cybersecurity career, so I am obviously biased towards network-centric security strategies and technologies. I also work for a network security monitoring company Corelight, but I am not writing this post in any corporate capacity...

The Patching Problem: Best Practices for Maintaining Up-to-Date Systems

"Update ready to be installed." IT teams and business stakeholders are probably familiar with this notification, or something like it. After all, software updates are nothing new: Whenever a vendor makes improvements or includes new capabilities on a previously-released platform, it comes with a...

Debian DLA-1553-1 : clamav security update

ClamAV is an anti-virus utility for Unix, whose upstream developers have released the version 0.100.2. Installing this new version is required to make use of all current virus signatures and to avoid warnings. This version also fixes a security issue discovered after version 0.100.1 :...

CVE-2018-18638

Neato Botvac Connected 2.2.0 is affected by a command-injection in the setup API. The vulnerability allows remote attackers to inject shell metacharacters in the ntp field of a JSON payload sent to /robot/initialize, enabling arbitrary command execution. Root cause: unsafely handled ntp field in ...

Best Practices for Endpoint Detection and Response

There are many elements that can complicate enterprise security efforts. From the increasing sophistication of cybercriminal strategies and activities to the wide range of components connected to the network, data protection and infrastructure security has become an uphill battle. Another key...