CVE-2021-41732

Removed by vendor...

CVE-2021-41732

An issue was discovered in zeek version 4.1.0. There is a HTTP request splitting vulnerability that will invalidate any ZEEK HTTP based security analysis. NOTE: the vendor's position is that the observed behavior is intended...

PT-2021-23387 · Zeek · Zeek

Name of the Vulnerable Software and Affected Versions: zeek version 4.1.0 Description: An issue was discovered in zeek that involves a HTTP request splitting vulnerability. This vulnerability will invalidate any ZEEK HTTP based security analysis. Recommendations: For zeek version 4.1.0, at the...

Zeek 环境问题漏洞

Zeek is a powerful network analysis framework. An environment issue vulnerability exists in zeek version 4.1.0 that will invalidate any security analysis based on ZEEK HTTP...

Exploit for CVE-2021-38647

cve-2021-38647 https://github.com/corelight/CVE-2021-38647 wit...

Exploit for CVE-2021-38647

CVE-2021-38647 AKA "OMIGOD" A Zeek package which detects CVE-2...

zeek -- several vulnerabilities

Tim Wojtulewicz of Corelight reports: Paths from log stream make it into system unchecked, potentially leading to commands being run on the system unintentionally. This requires either bad scripting or a malicious package to be installed, and is considered low severity. Fix potential unbounded...

Zeek in Action Videos

This is a quick note to point blog readers to my Zeek in Action YouTube video series for the Zeek network security monitoring project. Each video addresses a topic that I think might be of interest to people trying to understand their network using Zeek and adjacent tools and approaches, like...

Exploit for CVE-2021-1675

PrintNightmare CVE-2021-1675 This Zeek script detects succe...

FreeBSD : zeek -- several potential DoS vulnerabilities (a550d62c-f78d-4407-97d9-93876b6741b9)

Tim Wojtulewicz of Corelight reports : Fix potential Undefined Behavior in decodenetbiosname and decodenetbiosnametype BIFs. The latter has a possibility of a remote heap-buffer-overread, making this a potential DoS vulnerability. Add some extra length checking when parsing mobile ipv6 packets. D...

Exploit for Use After Free in Microsoft

CVE-2021-31166 Detection of attempts to exploit CVE-2021-31166...

Exploit for Use After Free in Microsoft

CVE-2021-31166 Detection Rules Different rules to detect if CV...

Exploit for Use After Free in Microsoft

CVE-2021-31166 Detection Rules Different rules to detect if CV...

zeek -- several potential DoS vulnerabilities

Tim Wojtulewicz of Corelight reports: Fix potential Undefined Behavior in decodenetbiosname and decodenetbiosnametype BIFs. The latter has a possibility of a remote heap-buffer-overread, making this a potential DoS vulnerability. Add some extra length checking when parsing mobile ipv6 packets. Du...

FreeBSD : zeek -- NULL pointer dereference vulnerability (bc83cfc9-42cf-4b00-97ad-d352ba0c5e2b)

Jon Siwek of Corelight reports : Fix NULL pointer dereference when encountering an invalid enum name in a config/input file that tries to read it into a setenum. For those that have such an input feed whose contents may come from external/remote sources, this is a potential DoS vulnerability. C...

FreeBSD : zeek -- Remote crash vulnerability (3e9624b3-e92b-4460-8a5a-93247c52c5a1)

Jon Siwek of Corelight reports : Fix ASCII Input reader's treatment of input files containing null-bytes. An input file containing null-bytes could lead to a buffer-over-read, crash Zeek, and be exploited to cause Denial of Service. C Tenable Network Security, Inc. The descriptive text and packag...

zeek -- Remote crash vulnerability

Jon Siwek of Corelight reports: Fix ASCII Input reader's treatment of input files containing null-bytes. An input file containing null-bytes could lead to a buffer-over-read, crash Zeek, and be exploited to cause Denial of Service...

zeek:zeek-packet-fuzzer: Heap-buffer-overflow in zeek::packet_analysis::GRE::GREAnalyzer::AnalyzePacket

Project: https://github.com/zeek/zeek.git Detailed Report: https://oss-fuzz.com/testcase?key=5436906734878720 Project: zeek Fuzzing Engine: honggfuzz Fuzz Target: zeek-packet-fuzzer Job Type: honggfuzzasanzeek Platform Id: linux Crash Type: Heap-buffer-overflow READ 2 Crash Address: 0x60300127b09...

FreeBSD : zeek -- Vulnerability due to memory leak (769a4f60-9056-4c27-89a1-1758a59a21f8)

Jon Siwek of Corelight reports : This release fixes the following security issue : - A memory leak in multipart MIME code has potential for remote exploitation and cause for Denial of Service via resource exhaustion. C Tenable Network Security, Inc. The descriptive text and package checks in this...

FreeBSD : zeek -- Various vulnerabilities (2c92fdd3-896c-4a5a-a0d8-52acee69182d)

Jon Siwek of Corelight reports : This release fixes the following security issue : - The AYIYA and GTPv1 parsing/decapsulation logic may leak memory -- These leaks have potential for remote exploitation to cause Denial of Service via resource exhaustion. C Tenable Network Security, Inc. The...