Vulnerability Spotlight: Vulnerabilities in Alyac antivirus program could stop virus scanning, cause code execution

Jaewon Min of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Update Aug. 3, 2022: Talos disclosed two new vulnerabilities in the Alyac antivirus software and added their details to this post. Cisco Talos recently discovered out-of-bounds read and buffer overflow vulnerabilitie...

Vulnerability Spotlight: Issue in Accusoft ImageGear could lead to memory corruption, code execution

Emmanuel Tacheau of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered a use-after-free vulnerability in Accusoft ImageGear's PSD header processing function. The ImageGear library is a document-imaging developer toolkit that allows users to create,...

Vulnerability Spotlight: Use-after-free condition in Google Chrome WebGPU

Piotr Bania of Cisco Talos discovered this vulnerability. Blog by Jon Munshaw. Cisco Talos recently discovered an exploitable use-after-free vulnerability in Google Chrome’s WebGPU standard. Google Chrome is a cross-platform web browser — and Chromium is the open-source version of the browser tha...

Vulnerability Spotlight: Adobe Acrobat DC use-after-free issues could lead to arbitrary code execution

Aleksandar Nikolic of Cisco Talos discovered these vulnerabilities. Blog by Jon Munshaw. Cisco Talos recently discovered two use-after-free vulnerabilities in Adobe Acrobat Reader DC that could allow an attacker to eventually gain the ability to execute arbitrary code. Acrobat is one of the most...

Microsoft Patch Tuesday for July 2022 — Snort rules and prominent vulnerabilities

By Jon Munshaw and Tiago Pereira. Microsoft released its monthly security update Tuesday, disclosing more than 80 vulnerabilities in the company’s various software, hardware and firmware offerings, including one that’s actively being exploited in the wild. July's security update... This is only t...

Microsoft Patch Tuesday for June 2022 — Snort rules and prominent vulnerabilities

By Chetan Raghuprasad. Microsoft released its monthly security update Tuesday, disclosing 55 vulnerabilities in the company’s firmware and software. One of these vulnerabilities is considered critical, 40 are listed as high severity, and the remainder is considered "moderate." The most... This is...

The vulnerability of the integration module of the Cisco Firepower Threat Defense (FTD) intrusion detection system’s microprogramming software allows a intruder to trigger a service failure.

The vulnerability of the integration module of the Snort intrusion detection system for Cisco Firepower Threat Defense FTD involves unlimited distribution of resources. Exploiting this vulnerability allows a malicious actor to cause service interruptions by sending a series of specially crafted I...

Cisco Firepower Threat Defense Snort Memory Leak DoS (cisco-sa-snort-dos-s2R7W9UU)

According to its self-reported version, Cisco FTD Software is affected by a denial of service vulnerability. A denial of service DoS vulnerability exists in the way the Snort detection engine processes ICMP traffic. An unauthenticated, remote attacker can exploit this issue by sending a series of...

Trellix Global Defenders: Follina — Microsoft Office Zero-Day (CVE-2022-30190)

Trellix Global Defenders: Follina — Microsoft Office Zero-Day CVE-2022-30190 By Taylor Mullins, Robin Noyce , Benjamin Marandel · June 3, 2022 Trellix is continuing to monitor the threat activity associated with the Microsoft Office Zero-Day vulnerability that has been dubbed “Follina.”...

The vulnerability of the evaluation function of the intrusion detection rules of the Snort system’s microprogramming software for Cisco Firepower Threat Defense (FTD) allows a perpetrator to trigger a service failure.

The vulnerability of the evaluation function of the intrusion detection rules of Cisco Firepower Threat Defense FTD is related to resource management errors. Exploiting this vulnerability can allow a malicious actor to trigger a service failure using specially created UDP packets...

Heyserial - Programmatically Create Hunting Rules For Deserialization Exploitation With Multiple Keywords, Gadget Chains, Object Types, Encodings, And Rule Types

Programmatically create hunting rules for deserialization exploitation with multiple keywords e.g. cmd.exe gadget chains e.g. CommonsCollection object types e.g. ViewState, Java, Python Pickle, PHP encodings e.g. Base64, raw rule types e.g. Snort, Yara Disclaimer Rules generated by this tool are...

Microsoft Patch Tuesday for May 2022 — Snort rules and prominent vulnerabilities

By Jon Munshaw, with contributions from Jaeson Schultz. Microsoft returned to its normal monthly patching volume in May, disclosing and fixing 74 vulnerabilities as part of the company’s latest security update. This month’s Patch Tuesday includes seven critical vulnerabilities after Microsoft...

Cisco Firepower Threat Defense Software Snort Out of Memory DoS (cisco-sa-ftd-snort-dos-hd2hFgM)

A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, which could lead to a denial of service DoS condition on an affected device. This vulnerability is due t...

CVE-2022-20767

A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of the DNS reputation enforcement...

CVE-2022-20751

A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, which could lead to a denial of service DoS condition on an affected device. This vulnerability is due t...

CVE-2022-20767

A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of the DNS reputation enforcement...

CVE-2022-20751

A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, which could lead to a denial of service DoS condition on an affected device. This vulnerability is due t...

CVE-2022-20767

A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of the DNS reputation enforcement...

Design/Logic Flaw

A vulnerability in the Snort rule evaluation function of Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper handling of the DNS reputation enforcement...

Race condition

A vulnerability in the Snort detection engine integration for Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to cause unlimited memory consumption, which could lead to a denial of service DoS condition on an affected device. This vulnerability is due t...