119 matches found
IRTriage - Incident Response Triage - Windows Evidence Collection For Forensic Analysis
Scripted collection of system information valuable to a Forensic Analyst. IRTriage will automatically "Run As ADMINISTRATOR" in all Windows versions except WinXP. The original source was Triage-ir v0.851 an Autoit script written by Michael Ahrendt. Unfortunately Michael's last changes were posted...
The vulnerability of the shadow_copy2_get_shadow_copy_data function in the Samba networking communication software package, related to information disclosure, allows a perpetrator to gain access to confidential data.
The vulnerability of the shadowcopy2getshadowcopydata function in the Samba networking communication software package is related to the disclosure of information. Exploiting this vulnerability could allow a malicious actor to gain access to confidential data remotely...
Update Rollup 7 for System Center 2012 R2 Data Protection Manager
Update Rollup 7 for System Center 2012 R2 Data Protection Manager Notice for users who installed Update Rollup 7 earlier than August 21, 2015 We had an issue with Update Rollup 7 in which expired recovery points were not getting cleaned up, and the release was pulled back. The update rollup was...
How to Use VSSTrace to Collect VSS Diagnostic Logging
Challenge This article explains how to collect additional VSS diagnostic data with the VSSTrace tool, a Microsoft Windows Software Development Kit SDK component. Cause Veeam products use Microsoft Volume Shadow Copy Service VSS for various tasks. Sometimes it is necessary to go through the...
Job fails to create VSS snapshot for SMB share
Challenge A File Backup/file to tape job skips VSS snapshot creation on SMB share and ends with the following message in the log: Failed to create a VSS snapshot, failing over to direct backup from the file share A File Backup job for an SMB3 File Share configured to use Backup from a Microsoft V...
Information Disclosure
samba4 is vulnerable to information disclosure attacks. The vulnerability exists when a certain vfs shadow copy configuration is enabled, does not properly initialize the SRVSNAPSHOTARRAY response field, which allows remote authenticated users to obtain potentially sensitive information from...
March 22, 2018—KB4088889 (OS Build 14393.2155)
None None...
Restore/SureBackup from old DC restore point fails due to shadow copy expiration
Challenge DC restore results in DSRM boot and event id 1918 from ActiveDirectoryDomainService stating: The shadow copy service cannot restore Active Directory Domain Services because the shadow copy used is too old. Copy Cause The backup of the DC is older than the tombstone period. Active...
Cannot find anymore diff area candidates for volume
Challenge Backup or replication of a Windows OS fails. In the Windows event logs of the machine being backed up, there is an error with ID 8193 from source VSS: Volume Shadow Copy Service error: Unexpected error calling routine Cannot find anymore diff area candidates for volume...
The vulnerability of Samba software allows a remote attacker to compromise the confidentiality of protected information.
The vulnerability exists in Samba under certain settings of shadow copying vfs. It stems from an improper initialization of the SRVSNAPSHOTARRAY field. Exploiting this vulnerability allows remote users who have passed authentication to access confidential information from the process’s memory,...
Latest TeslaCrypt Targets New File Extensions, Invests Heavily in Evasion
TeslaCrypt, like many of its ransomware cousins, doesn’t sleep on past success. Researchers at Endgame Inc., have found two updates for the cryptoransomware in the past two weeks that invest heavily in obfuscation and evasion techniques, and also target a host of new file extensions. These sample...
Samba: Missing access control check in shadow copy code
A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORYLIST access rights...
Samba: Missing access control check in shadow copy code
A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORYLIST access rights...
Samba: Missing access control check in shadow copy code
A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORYLIST access rights...
Samba: Missing access control check in shadow copy code
A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORYLIST access rights...
Samba: Missing access control check in shadow copy code
A missing access control flaw was found in Samba. A remote, authenticated attacker could use this flaw to view the current snapshot on a Samba share, despite not having DIRECTORYLIST access rights...
Samba 4.2.x < 4.2.7 / 4.3.x < 4.3.3 Multiple Vulnerabilities
According to its banner, the version of Samba running on the remote host is 4.2.x prior to 4.2.7 or 4.3.x prior to 4.3.3. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in the ldbwildcardcompare function in file ldbmatch.c due to mishandli...
Samba 4.x < 4.1.22 Multiple Vulnerabilities
According to its banner, the version of Samba running on the remote host is 4.x prior to 4.1.22. It is, therefore, affected by the following vulnerabilities : - A denial of service vulnerability exists in the ldbwildcardcompare function in file ldbmatch.c due to mishandling certain zero values. A...
USN-2855-1 samba vulnerabilities
Thilo Uttendorfer discovered that the Samba LDAP server incorrectly handled certain packets. A remote attacker could use this issue to cause the LDAP server to stop responding, resulting in a denial of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 15.04 and Ubuntu 15.10. CVE-2015-322...
Samba Bypass Access Privilege Vulnerability
Samba is a set of programs that implement the SMB Server Messages Block protocol, cross-platform file sharing and print sharing services. An access privilege bypass vulnerability exists in the shadowcopy2getshadowcopydata function in the /vfsshadowcopy2.c module in Samba versions 4.x before 4.1.2...