CAREL PlantVisor Enhanced Authentication Bypass Vulnerability

OVERVIEW Independent researcher Maxim Rupp has identified an authorization bypass vulnerability in CAREL’s PlantVisor application. CAREL has confirmed that this vulnerability refers to the phased-out CAREL product PlantVisorEnhanced and is no longer supported. This vulnerability could be exploite...

Cisco Releases Security Update

Cisco has released a security update to address a vulnerability in its Cisco WebEx Meetings Player. Exploitation of this vulnerability could allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Cisco Security Advisory and apply t...

Siemens OZW672 and OZW772 XSS Vulnerability

OVERVIEW Independent researcher Aditya Sood has identified a cross-site scripting vulnerability in Siemens OZW672 and OZW772 devices. Siemens has produced a firmware update to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS Siemens reports that the...

Linux Kernel Vulnerability

US-CERT is aware of a Linux kernel vulnerability known as Dirty COW CVE-2016-5195. Exploitation of this vulnerability may allow an attacker to take control of an affected system. US-CERT recommends that users and administrators review the Red Hat CVE Database, the Canoical Ubuntu CVE Tracker, and...

ISC Releases Security Advisory

The Internet Systems Consortium ISC has released a security advisory to highlight a vulnerability in versions of BIND software released before May 2013, and in third-party versions that do not include fix 3548. Exploitation of this vulnerability may allow a remote attacker to cause a...

Mozilla Releases Security Update for Firefox

Mozilla has released Firefox 49.0.2 to address a security vulnerability. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Mozilla Security Advisory for Firefox and apply the necessary update...

Cisco Releases Security Updates

Cisco has released security updates to address vulnerabilities in multiple products. A remote attacker could exploit some of these vulnerabilities to take control of an affected system. US-CERT encourages users and administrators to review the following Cisco Security Advisories and apply the...

Adobe Releases Security Updates

Adobe has released security updates to address vulnerabilities in Flash Player and the Creative Cloud Desktop Application. Exploitation of some of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Adobe...

Potential Hurricane Matthew Phishing Scams

US-CERT warns users to remain vigilant for malicious cyber activity seeking to capitalize on interest in Hurricane Matthew. Users are advised to exercise caution in handling any email with subject line, attachments, or hyperlinks related to Hurricane Matthew, even if it appears to originate from ...

CERT Basic Fuzzing Framework: BFF

CERT Basic Fuzzing Framework The CERT Basic Fuzzing Framework BFF is a software testing tool that finds defects in applications that run on the Linux and Mac OS X platforms. BFF performs mutational fuzzing on software that consumes file input. Mutational fuzzing is the act of taking well-formed...

National Cyber Security Awareness Month

October is National Cyber Security Awareness Month, an annual campaign to raise awareness about cybersecurity. In partnership with DHS, the National Cyber Security Alliance has released the first in a series of tips focused on helping people protect their online activities and increase their...

SUSE SLES11 Security Update : curl (SUSE-SU-2016:2449-1)

This update for curl fixes the following issues : - CVE-2016-5419: TLS session resumption client cert bypass bsc991389 - CVE-2016-5420: Re-using connections with wrong client cert bsc991390 - CVE-2016-7141: Fixed incorrect reuse of client certificates bsc997420. Note that Tenable Network Security...

ICS-CERT Report Grim Reminder of State of Critical Infrastructure Security

U.S. critical infrastructure got another reminder this week that it needs to do more to protect itself from cyber attacks with the release of an annual government report. The NCCIC/ICS-CERT FY 2015 Annual Vulnerability Coordination Report points out that nagging issues continue to plague industri...

Google Releases Security Update for Chrome

Google has released Chrome version 53.0.2785.143 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of one of these vulnerabilities may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review the Chrome Releas...

ISC Releases Security Updates for BIND

The Internet Systems Consortium ISC has released updates that address a vulnerability in BIND. Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition. Available updates include: BIND 9 version 9.9.9-P3 BIND 9 version 9.10.4-P3 BIND 9 version 9.11.0rc...

FTC Releases Data Breach Recovery and Prevention Video

The Federal Trade Commission FTC has released a step-by-step video to users whose personal information may have been exposed in a data breach. This video provides instruction on how to report an incident and develop a personal recovery plan after a data breach has occurred. US-CERT encourages use...

FATEK Automation PLC WinProladder Stack-Based Buffer Overflow Vulnerability

OVERVIEW A researcher working with Trend Micro’s Zero Day Initiative ZDI has identified a stack-based buffer overflow vulnerability in FATEK Automation's PLC WinProladder application. Fatek Automation Fatek has not produced an update to mitigate this vulnerability. ZDI has coordinated with...

Siemens SIMATIC WinCC and SIMATIC PCS 7 ActiveX Vulnerability

OVERVIEW Mingzheng Li from Acorn Network Security Lab has identified an ActiveX vulnerability in Siemens’ SIMATIC WinCC and SIMATIC PCS 7. Siemens has produced a new version to mitigate this vulnerability. This vulnerability could be exploited remotely. AFFECTED PRODUCTS Siemens reports that the...

VMWare Releases Security Updates

VMware has released a security update to address vulnerabilities in vSphere Hypervisor ESXi, Workstation Pro, Workstation Player, Fusion, and Tools. Exploitation of one of these vulnerabilities could allow a remote attacker to take control of an affected system. US-CERT encourages users and...

Google Releases Security Update for Chrome

Google has released Chrome version 53.0.2785.113 to address multiple vulnerabilities for Windows, Mac, and Linux. Exploitation of some of these vulnerabilities may allow an attacker to take control of an affected system. US-CERT encourages users and administrators to review the Chrome Releases pa...