65 matches found
AIX : Multiple Vulnerabilities (IJ37355)
The version of AIX installed on the remote host is prior to APAR IJ37355. It is, therefore, affected by multiple vulnerabilities as referenced in the IJ37355 advisory. - IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial...
CVE-2022-22350: Undefined Security Weakness
IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 220394...
Security Bulletin: Vulnerabilities in AIX CAA (CVE-2022-22350, CVE-2021-38996)
Summary There are multiple vulnerabilities in AIX CAA. Vulnerability Details CVEID: CVE-2022-22350 DESCRIPTION: IBM AIX could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. CVSS Base score: 6.2 CVSS Temporal Score: See:...
Vulnerabilities in AIX CAA
IBM SECURITY ADVISORY First Issued: Tue Mar 1 09:31:15 CST 2022 The most recent version of this document is available here: http://aix.software.ibm.com/aix/efixes/security/caaadvisory2.asc https://aix.software.ibm.com/aix/efixes/security/caaadvisory2.asc...
PT-2022-15382
Name of the Vulnerable Software and Affected Versions IBM AIX versions 7.1 through 7.3 VIOS version 3.1 Description The issue allows a non-privileged local user to exploit a vulnerability in the CAA component to cause a denial of service. This can be achieved by exploiting a vulnerability in the...
bind security update
32:9.8.2-0.68.rc1.0.3.8 - Backport fix for CVE-2018-5741 Orabug: 33496185 32:9.8.2-0.68.rc1.0.2.8 - Backport possible assertion failure on DNAME processing CVE-2021-25215 32:9.8.2-0.68.rc1.0.1.8 - Backport the fix for buffer overflow CVE-2020-8625 Orabug: 32588749 32:9.8.2-0.68.rc1.8 - Fix...
Sifchain: Misconfiguration Certificate Authority Authorization Rule
Hello,Sifchain Security Team, I found a bug called Missing CAA. Certificate Authority Authorization supported by LetsEncrypt and other CAs allows a domain owner to specify which Certificate Authorities should be allowed to issue certificates for the domain. All CAA-compliant certificate authoriti...
PT-2020-22013
Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a crash type of Use-of-uninitialized-value. The crash occurs in the ares parse caa reply function, as indicated by a report from...
Endless Group: Lets Encrypt Certificates affected by CAA Rechecking Incident
Summary: Lets encrypt released a statement regarding 3 million certificates being revoked due to a issue in the CA signing process, Looking at your subdomains it appears that you are affected by this incident. When the revoking occurs the certificates the certificates are no longer valid. This ma...
Identifying Let’s Encrypt Revoked Certificates
Let's Encrypt is a free, automated, open certificate authority CA run for the public's benefit as a service from the Internet Security Research Group ISRG. It provides free digital certificates to enable HTTPS SSL/TLS for websites via user-friendly means. Earlier this week, Let's Encrypt announce...
Let’s Encrypt Pushes Back Deadline to Revoke Some TLS Certificates
Let’s Encrypt said it will give users of its Transport Layer Security TLS certificates more time to replace 1 million certificates that are still active and potentially affected by a Certificate Authority Authorization CAA bug before it revokes them. The popular free certificate authority had giv...
Let's Encrypt Vulnerability
The BBC is reporting a vulnerability in the Let's Encrypt certificate service: In a notification email to its clients, the organisation said: "We recently discovered a bug in the Let's Encrypt certificate authority code. "Unfortunately, this means we need to revoke the certificates that were...
Let's Encrypt to Revoke Millions of TLS Certs
UPDATE Popular free certificate authority Let’s Encrypt said it will revoke 3 million Transport Layer Security TLS certificates Wednesday, because of a Certificate Authority Authorization CAA bug. The move could mean that millions of websites and machine identities that rely on those certificates...
ASSURE Aviation Cyber Security Testing
We've long been supporters and champions of a formalised approach to Aviation Cyber Security Testing. Our research and blogging has taken us on an interesting journey regarding airside and landside security, mapping attack surfaces and explaining how systems work and interact. Speaking and...
php: memcpy with negative length via crafted DNS response
An issue was discovered in PHP 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.2. dnsgetrecord misparses a DNS response, which can allow a hostile DNS server to cause PHP to misuse memcpy, leading to read operations going past the buffer allocated for DNS data. This affects phpparser...
Design/Logic Flaw
cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling SEC-439...
CVE-2018-20892
CVE-2018-20892 affects cPanel prior to 74.0.0, where incorrect handling of CAA records allows arbitrary zone file modifications. Root cause: CAA handling flaw in the affected component. Impact per sources is modification of DNS zone data. No exploitation details or patches are specified in the pr...
CVE-2018-20892
cPanel before 74.0.0 allows arbitrary zone file modifications because of incorrect CAA record handling SEC-439...
PT-2019-10322
Name of the Vulnerable Software and Affected Versions: cPanel versions prior to 74.0.0 Description: The issue arises from incorrect CAA record handling, allowing arbitrary zone file modifications. Recommendations: For versions prior to 74.0.0, update to version 74.0.0 or later to resolve the issu...