Threat Source newsletter (Jan. 14, 2021)

Newsletter compiled by Jon Munshaw. Good afternoon, Talos readers. Microsoft released its monthly security update this week, disclosing 83 vulnerabilities across its suite of products to kickoff 2021. Our blog post has the most important vulnerabilities you need to know about, along with our...

CVE-2021-3139

A flaw was found in the Linux kernel’s implementation of the Linux SCSI target host, where an authenticated attacker could write to any block on the exported SCSI device backing store. This flaw allows an authenticated attacker to send LIO block requests to the Linux system to overwrite data on t...

Latest round of OCR audits highlight HIPAA risk analysis and risk management shortcomings

The Office for Civil Rights OCR at the U.S. Department of Health and Human Services HHS has released its latest report with findings from their 2016 and 2017 series of audits as required under the Health Insurance Portability and Accountability Act of 1996 HIPAA/HITECH Privacy, Security, and Brea...

UBUNTU-CVE-2021-20177

A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user with root or CAPNETADMIN when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected...

Linux: Get iptables and ip6tables (KB)

Iptables is used to set up, maintain, and inspect the tables of IP packet filter rules in the Linux kernel. Several different tables may be defined. Each table contains a number of built-in chains and may also contain user-defined chains. Ip6tables is used to set up, maintain, and inspect the...

CVE-2021-20177

A flaw was found in the Linux kernel's implementation of string matching within a packet. A privileged user with root or CAPNETADMIN when inserting iptables rules could insert a rule which can panic the system. Kernel before kernel 5.5-rc1 is affected...

OPENSUSE-SU-2021:0045-1 Security update for rpmlint

This update for rpmlint fixes the following issues: - Whitelist PAM modules and DBUS rules for cockpit bsc1169614 This update was imported from the SUSE:SLE-15:Update update project...

Security update for rpmlint (moderate)

openSUSE Security Update: Security update for rpmlint Announcement ID: openSUSE-SU-2021:0045-1 Rating: moderate References: 1169614 Affected Products: openSUSE Leap 15.1 An update that contains security fixes can now be installed. Description: This update for rpmlint fixes the following issues: -...

MUD-Visualizer - A Tool To Visualize MUD Files

This tool can be used to visualize the MUD files in JSON format. Motivation MUD files are plain text files in JSON format that contain ACL rules for a device. A MUD file can contains tens or hundrends of ACL rules which makes it difficult to read and validate the files manually. mud-visualizer wi...

TP-Link TL-WR840N OS Command Injection Vulnerability

The TP-LINK TL-WR840N is a wireless router with a channel count of 13 and VPN support. An OS command injection vulnerability exists in oaliptaddBridgeIsolationRules in TP-Link TL-WR840N 6EU0.9.14.16. The vulnerability stems from raw strings entered from the web interface being used to call system...

CVE-2020-36178

oaliptaddBridgeIsolationRules on TP-Link TL-WR840N 6EU0.9.14.16 devices allows OS command injection because a raw string entered from the web interface an IP address field is used directly for a call to the system library function for iptables. NOTE: oaliptaddBridgeIsolationRules is not the only...

CVE-2020-10657

The Proofpoint Insider Threat Management Server formerly ObserveIT Server before 7.9.1 contains a vulnerability in the ITM web console's ImportAlertRules feature. The vulnerability allows a remote attacker with admin or config-admin privileges in the console to execute arbitrary code with local...

[SECURITY] Fedora 33 Update: perl-Convert-ASN1-0.27-21.fc33

Convert::ASN1 encodes and decodes ASN.1 data structures using BER/DER rules...

EulerOS Virtualization for ARM 64 3.0.2.0 : cifs-utils (EulerOS-SA-2021-1054)

According to the version of the cifs-utils package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability : - It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used ...

ApkLeaks - Scanning APK File For URIs, Endpoints And Secrets

Scanning APK file for URIs, endpoints & secrets. Installation To install apkLeaks , simply: $ git clone https://github.com/dwisiswant0/apkleaks $ cd apkleaks/ $ pip install -r requirements.txt Or download at release tab. Dependencies This package works in Python2 not Python3. Install global...

Common Security Misconfigurations and Their Consequences

Everyone makes mistakes. That one sentence was drummed into me in my very first job in tech, and it has held true since then. In the cybersecurity world, misconfigurations can create exploitable issues that can haunt us later - so let's look at a few common security misconfigurations. The first o...

Virtuozzo 7 : bind / bind-chroot / bind-devel / etc (VZLSA-2020-5011)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:5011 advisory. - bind: truncated TSIG response can lead to an assertion failure CVE-2020-8622 - bind: remotely triggerable assertion failure in pk11.c...

Should There Be Limits on Persuasive Technologies?

Persuasion is as old as our species. Both democracy and the market economy depend on it. Politicians persuade citizens to vote for them, or to support different policy positions. Businesses persuade consumers to buy their products or services. We all persuade our friends to accept our choice of...

OPENSUSE-SU-2020:2232-1 Security update for rpmlint

This update for rpmlint fixes the following issues: - Whitelist PAM modules and DBUS rules for cockpit bsc1169614 This update was imported from the SUSE:SLE-15:Update update project. This update was imported from the openSUSE:Leap:15.2:Update update project...

Security update for rpmlint (moderate)

openSUSE Security Update: Security update for rpmlint Announcement ID: openSUSE-SU-2020:2232-1 Rating: moderate References: 1169614 Affected Products: openSUSE Backports SLE-15-SP2 An update that contains security fixes can now be installed. Description: This update for rpmlint fixes the followin...