CVE-2023-30576 Apache Guacamole: Use-after-free in handling of RDP audio input buffer

Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbitrary code with the privileges of the guacd process...

PT-2023-22797 · Apache +1 · Apache Guacamole +1

Name of the Vulnerable Software and Affected Versions: Apache Guacamole versions 0.9.10 through 1.5.1 Description: The issue allows an attacker to execute arbitrary code with the privileges of the guacd process, depending on timing, as Apache Guacamole may continue to reference a freed RDP audio...

UPM Profile Gets Corrupt If Users With Same SAM Account Name In Different Domains Login

UPM profile gets corrupt if users with same SAM Account name in different domains login to the same VDA. Issue is seen with 1912 LTSR CU5 and above and 2203 LTSR CU1 and above. USER1.DomainA.com logson a VDA and then User1.DomainB.com logs on the same VDA then the local profile of user1.Domain A...

#StopRansomware: BianLian Ransomware Group

Actions to take today to mitigate cyber threats from BianLian ransomware and data extortion: 1. Strictly limit the use of RDP and other remote desktop services. 2. Disable command-line and scripting activities and permissions. 3. Restrict usage of PowerShell and update Windows PowerShell or...

freerdp: out of bounds read in zgfx decoder

An out-of-bounds read vulnerability was found in the ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out-of-bound data and try to decode it. This will result in a crash, causing a denial of service...

Citrix ADC and Citrix Gateway Multiple Vulnerabilities (CTX477714)

The remote Citrix ADC or Citrix Gateway device is version 12.1 before 12.1-65.35, 12.1-FIPS before 12.1-55.296, 13.0 before 13.0-90.11 or 13.1 before 13.1-45.61. It is therefore affected by multiple vulnerabilities: - A cross-site scripting vulnerability affecting appliances configured as a Gatew...

Native Windows Camera application is not working in Citrix session.

Native Windows Camera application is not working in Citrix session. Issue is not seen in a RDP session...

A week in security (April 10 - 16)

Last week on Malwarebytes Labs: How the cops buy a "God view" of your location data, with Bennett Cyphers: Lock and Code S04E09 Apple releases emergency updates for two known-to-be-exploited vulnerabilities Don't plug your phone into a free charging station, warns FBI KFC, Pizza Hut owner employe...

Port scan attacks: Protecting your business from RDP attacks and Mirai botnets

Compromised IP addresses and domains--otherwise legitimate sites that are exploited by hackers without the owner's knowledge--are frequently utilized to conduct port scanning attacks. Port scanning involves systematically scanning a computer network for open ports, which can then be exploited by...

FreeBSD : zeek -- potential DoS vulnerabilities (96d6809a-81df-46d4-87ed-2f78c79f06b1)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 96d6809a-81df-46d4-87ed-2f78c79f06b1 advisory. - Tim Wojtulewicz of Corelight reports: Receiving DNS responses from async DNS requests via A...

KFC, Pizza Hut owner employee data stolen in ransomware attack

Upon learning that attackers accessed and siphoned data in January, Yum! Brands, the fast-food chain operator behind The Habit Burger Grill, KFC, Pizza Hut, and Taco Bell, has begun sending Notice of Security Breach letters to employees whose data were potentially affected. "We are writing to...

zeek -- potential DoS vulnerabilities

Tim Wojtulewicz of Corelight reports: Receiving DNS responses from async DNS requests via A specially-crafted stream of FTP packets containing a command reply with many intermediate lines can cause Zeek to spend a large amount of time processing data. A specially-crafted set of packets containing...

Cisco Duo Authentication for macOS Logon Offline Credentials Replay (cisco-sa-duo-replay-knuNKd)

According to its self-reported version, Cisco Duo Authentication for macOS is affected by a vulnerability. A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker...

CVE-2023-20123

A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker to replay valid user session credentials and gain unauthorized access to an affected macOS or Windows...

CVE-2023-20123 Cisco Duo Authentication for macOS and Duo Authentication for Windows Logon Offline Credentials Replay Vulnerability

A vulnerability in the offline access mode of Cisco Duo Two-Factor Authentication for macOS and Duo Authentication for Windows Logon and RDP could allow an unauthenticated, physical attacker to replay valid user session credentials and gain unauthorized access to an affected macOS or Windows...

CVE-2023-20123

Cisco Duo for macOS and Duo Authentication for Windows Logon offline Credential replay vulnerability (CVE-2023-20123) allows an unauthenticated, physical attacker to replay previously used MFA codes because session credentials do not expire properly. Affected products include Cisco Duo on macOS a...

Fingerprintx - Standalone Utility For Service Discovery On Open Ports!

fingerprintx is a utility similar to httpx that also supports fingerprinting services like as RDP, SSH, MySQL, PostgreSQL, Kafka, etc. fingerprintx can be used alongside port scanners like Naabu to fingerprint a set of ports identified during a port scan. For example, an engineer may wish to scan...

Debian dla-3370 : xrdp - security update

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3370 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-3370-1 [email protected]...

[SECURITY] Fedora 38 Update: guacamole-server-1.5.0-2.fc38

Guacamole is an HTML5 remote desktop gateway. Guacamole provides access to desktop environments using remote desktop protoc ols like VNC and RDP. A centralized server acts as a tunnel and proxy, allowing access to multiple desktops through a web browser. No browser plugins are needed, and no clie...

Fedora: Security Advisory for guacamole-server (FEDORA-2023-a5e10b188a)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...