CVE-2019-19648

In the machoparsefile functionality in macho/macho.c of YARA 3.11.0, commandsize may be inconsistent with the real size. A specially crafted MachO file can cause an out-of-bounds memory access, resulting in Denial of Service application crash or potential code execution...

CVE-2019-19648

CVE-2019-19648 affects YARA 3.11.0 in macho_parse_file (macho/macho.c) where command_size may not match the actual size, enabling an out-of-bounds memory access that can cause DoS (crash) or potential code execution via a crafted Mach-O file. Connected sources confirm the vulnerability in YARA an...

YARA has unspecified vulnerabilities

YARA is a set of tools used to help software researchers identify and categorize malware samples. A security vulnerability exists in the machoparsefile function of the macho/macho.c file in YARA version 3.11.0. The vulnerability can be exploited by an attacker to cause out-of-bounds memory access...

PT-2019-15900

Name of the Vulnerable Software and Affected Versions YARA version 3.11.0 Description The issue arises from inconsistent command size in the macho parse file functionality, which can lead to out-of-bounds memory access when a specially crafted MachO file is processed. This can result in a Denial ...

CAPE - Malware Configuration And Payload Extraction

CAPE is a malware sandbox. It is derived from Cuckoo and is designed to automate the process of malware analysis with the goal of extracting payloads and configuration from malware. This allows CAPE to detect malware based on payload signatures, as well as automating many of the goals of malware...

yara:dotnet_fuzzer: Heap-use-after-free in dotnet_parse_tilde_2

Project: https://github.com/VirusTotal/yara.git Detailed Report: https://oss-fuzz.com/testcase?key=5195285818507264 Project: yara Fuzzing Engine: libFuzzer Fuzz Target: dotnetfuzzer Job Type: libfuzzerasanyara Platform Id: linux Crash Type: Heap-use-after-free READ 2 Crash Address: 0x6190000006f2...

yara:dotnet_fuzzer: Use-of-uninitialized-value in pe_rva_to_offset

Project: https://github.com/VirusTotal/yara.git Detailed Report: https://oss-fuzz.com/testcase?key=5676620769918976 Project: yara Fuzzing Engine: libFuzzer Fuzz Target: dotnetfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

yara:rules_fuzzer: Index-out-of-bounds in yara_yyparse

Project: https://github.com/VirusTotal/yara.git Detailed Report: https://oss-fuzz.com/testcase?key=5154134441590784 Project: yara Fuzzing Engine: libFuzzer Fuzz Target: rulesfuzzer Job Type: libfuzzerubsanyara Platform Id: linux Crash Type: Index-out-of-bounds Crash Address: Crash State:...

yara:rules_fuzzer: Use-of-uninitialized-value in yr_arena_destroy

Project: https://github.com/VirusTotal/yara.git Detailed Report: https://oss-fuzz.com/testcase?key=5681595617116160 Project: yara Fuzzing Engine: libFuzzer Fuzz Target: rulesfuzzer Job Type: libfuzzermsanyara Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State:...

yara:rules_fuzzer: Heap-double-free in yara_yyparse

Project: https://github.com/VirusTotal/yara.git Detailed Report: https://oss-fuzz.com/testcase?key=5123250044796928 Project: yara Fuzzing Engine: afl Fuzz Target: rulesfuzzer Job Type: aflasanyara Platform Id: linux Crash Type: Heap-double-free Crash Address: 0x6120012ffd00 Crash State: yarayypar...

ThreatIngestor - Extract And Aggregate Threat Intelligence

An extendable tool to extract and aggregate IOCs from threat feeds. Integrates out-of-the-box with ThreatKB and MISP, and can fit seamlessly into any existing worflow with SQS, Beanstalk, and custom plugins. Overview ThreatIngestor can be configured to watch Twitter, RSS feeds, or other sources,...

Fedora 30 : yara (2019-a00b4760a0)

bugfix bump to 3.10.0 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. C Tenable Network Security,...

[SECURITY] Fedora 30 Update: yara-3.10.0-2.fc30

YARA is a tool aimed at but not limited to helping malware researchers to identify and classify malware samples. With YARA you can create descriptions of malware families or whatever you want to describe based on textual or binary patterns. Each description, a.k.a rule, consists of a set of strin...

Fedora Update for yara FEDORA-2019-a00b4760a0

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fenrir - Simple Bash IOC Scanner

Fenrir is a simple IOC scanner bash script. It allows scanning Linux/Unix/OSX systems for the following Indicators of Compromise IOCs: Hashes MD5, SHA1 and SHA256 using md5sum, sha1sum, sha -a 256 File Names string - checked for substring of the full path, e.g. "temp/p.exe" in "/var/temp/p.exe"...

CB TAU Threat Intelligence Notification: Winnti Malware 4.0

Winnti is a family of malware used by multiple Chinese threat actors like APT41. Carbon Black’s Threat Analysis Unit TAU is providing this technical analysis, YARA rules, IOCs and product rules for the research community. Behavioral Summary Winnti malware is installed manually with stolen...

PEpper - An Open Source Script To Perform Malware Static Analysis On Portable Executable

An open source tool to perform malware static analysis on P ortable E xecutable Installation eva@paradise:$ git clone https://github.com/Th3Hurrican3/PEpper/ eva@paradise:$ cd PEpper eva@paradise:$ pip3 install -r requirements.txt eva@paradise:$ python3 pepper.py ./malwaredir Screenshot...

yara:dotnet_fuzzer: Crash in dotnet_parse_tilde_2

Project: https://github.com/VirusTotal/yara.git Detailed Report: https://oss-fuzz.com/testcase?key=5112220729475072 Project: yara Fuzzing Engine: libFuzzer Fuzz Target: dotnetfuzzer Job Type: libfuzzerubsanyara Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x000002507000 Crash State:...

Yara <= 3.8.1 Denial of Service (DoS) Vulnerability

Yara is prone to a denial of service DoS vulnerability. Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software...

CVE-2019-5020

An exploitable denial of service vulnerability exists in the object lookup functionality of Yara 3.8.1. A specially crafted binary file can cause a negative value to be read to satisfy an assert, resulting in Denial of Service. An attacker can create a malicious binary to trigger this vulnerabili...