UPDATE: Sysdig Falco v0.7.0

PenTestIT RSS Feed A few months ago, I posted about an open source behavorial activity monitor. It was updated some time ago and we now have update - the Sysdig Falco v0.7.0! What is Sysdig Falco? Sysdig Falco is a behavioral activity monitor designed to detect anomalous activity in your...

My comments on Forrester’s “Vulnerability Management vendor landscape 2017”

A top consulting company, Forrester Research, recently published report "Vendor Landscape: Vulnerability Management, 2017". You can read for free by filling a small form on Tenable web site. What's interesting in this document? First of all, Josh Zelonis and co-authors presented their version of ...

Important: docker

Issue Overview: It was discovered that runC allowed additional container processes via runc exec to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file descriptors of these new processes during the initialization,...

USN-3136-1: LXC vulnerability

Roman Fiedler discovered a directory traversal flaw in lxc-attach. An attacker with access to an LXC container could exploit this flaw to access files outside of the container...

docker: privilege escalation via confusion of usernames and UIDs

It was found that Docker would launch containers under the specified UID instead of a username. An attacker able to launch a container could use this flaw to escalate their privileges to root within the launched container...

CVE-2016-1582

CVE-2016-1582 concerns LXD before 2.0.2, where switching an unprivileged container to privileged mode incorrectly sets permissions. This allows a local user to access arbitrary world-readable paths in the container directory via unspecified vectors. The provided documents confirm the affected pro...

Clair - Vulnerability Static Analysis for Containers

Clair is an open source project for the static analysis of vulnerabilities in appc and docker containers. Vulnerability data is continuously imported from a known set of sources and correlated with the indexed contents of container images in order to produce lists of vulnerabilities that threaten...

docker: privilege escalation via confusion of usernames and UIDs

It was found that Docker would launch containers under the specified UID instead of a username. An attacker able to launch a container could use this flaw to escalate their privileges to root within the launched container...

MGASA-2016-0043 Updated docker/golang packages fix security vulnerability

Manipulated layer IDs could have lead to local graph poisoning CVE-2014-8178. Manifest validation and parsing logic errors allowed pull-by-digest validation bypass CVE-2014-8179. To fix these issues, the golang package has been updated to version 1.4.3 and the docker package has been updated to...

DEBIAN-CVE-2015-3631

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules LSM and dockert policies via an image that allows volumes to override files in /proc...

Re: Bypassing Inherited Rights Filters in Novell Directory Services.

At 07:24 PM 9/7/2000 -0700, you wrote: Here's an example. An administrator, .BOB.ACME, has Supervisor S rights to the .ACME container. There is a container, .SECRET.ACME, which BOB should not have any access to. If you understood NDS sufficiently, you wouldn't give Bob S rights to a container whe...