Claymore's Dual Ethereum Miner unauth stack buffer overflow(CVE-2017-16929)

VuNote =================== Author: Ref: https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-16929 Version: 0.2 Date: Nov 30th, 2017 Tag: claymore dual ethereum decred crypto currency miner Overview -------- Name: Claymore's Dual ETH + DCR/SC/LBC/PASC GPU Miner Vendor: nanopool/claymore...

CEMLink 6 Unrestricted WSDL Service Access / Poor Crypto Implementation Vulnerabilities

CEMLink 6 suffers from having unrestricted WSDL service access and a weak mechanism for password storage. Exploit Title: CEMLink6 multiple vulnerabilities Date Reported to vendor: 8/2/2017 Vendor never replied Exploit Author: email protected Vendor Homepage:...

Linux kernel denial of service vulnerability (CNVD-2017-36476)

Linux kernel is the kernel used by Linux, the open source operating system released by the Linux Foundation in the United States. A denial of service vulnerability exists in the 'rngapireset' function of the crypto/rng.c file in versions of Linux kernel prior to 4.2. An attacker exploits this...

Threat Round Up for Nov 10 - Nov 17

Today, Talos is publishing a glimpse into the most prevalent threats we've observed between November 10 and November 17. As with previous round-ups, this post isn't meant to be an in-depth analysis. Instead, this post will summarize the threats we've observed by highlighting key behavior...

[SECURITY] Fedora 25 Update: libgcrypt-1.7.9-1.fc25

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

[SECURITY] Fedora 27 Update: botan-1.10.17-1.fc27

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

IT threat evolution Q3 2017. Statistics

Q3 figures According to KSN data, Kaspersky Lab solutions detected and repelled 277,646,376 malicious attacks from online resources located in 185 countries all over the world. 72,012,219 unique URLs were recognized as malicious by web antivirus components. Attempted infections by malware that ai...

OracleVM 3.4 : Unbreakable / etc (OVMSA-2017-0167)

The remote OracleVM system is missing necessary patches to address critical security updates : - Revert 'drivers/char/mem.c: deny access in open operation when securelevel is set' Brian Maly Orabug: 27037811 - xfs: use dedicated log worker wq to avoid deadlock with cil wq Brian Foster Orabug:...

[SECURITY] Fedora 26 Update: libgcrypt-1.7.9-1.fc26

Libgcrypt is a general purpose crypto library based on the code used in GNU Privacy Guard. This is a development version...

Insecure Cryptography

crypto-browserify is generates cryptographically insecure random numbers. The library uses the native JavaScript Math.Random to generate random numbers, that has been proven as not secure...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2017-3635)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-3635 advisory. - scsi: scsitransportiscsi: fix the issue that iscsiifrx doesn't parse nlmsg properly Xin Long Orabug: 26988633 CVE-2017-14489 - ipv6: avoid overfl...

Network Time Protocol Crypto-NAK Preemptible Association Denial of Service Vulnerability(CVE-2016-1547)

SUMMARY An off-path attacker can cause a preemptible client association to be demobilized by sending a crypto NAK packet to a victim client with a spoofed source address of an existing associated peer. This is true even if authentication is enabled. Furthermore, if the attacker keeps sending cryp...

[SECURITY] Fedora 26 Update: botan-1.10.17-1.fc26

Botan is a BSD-licensed crypto library written in C++. It provides a wide variety of basic cryptographic algorithms, X.509 certificates and CRLs, PKCS \10 certificate requests, a filter/pipe message processing system, and a wide variety of other features, all written in portable C++. The API...

Oracle Linux 6 / 7 : java-1.8.0-openjdk (ELSA-2017-2998)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2017-2998 advisory. 1:1.8.0.151-1.b12 - repack policies adapted to new counts and paths - note that also c-j-c is needed to make this apply in next update - Resolves:...

openSUSE Security Update : the Linux Kernel (openSUSE-2017-1159)

The openSUSE Leap 42.2 Kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service assertion failure, and hypervisor hang or crash via ...

openSUSE Security Update : the Linux Kernel (openSUSE-2017-1160)

The openSUSE Leap 42.3 kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed : - CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service assertion failure, and hypervisor hang or crash via ...

dotCMS 4.1.1 XSS Vulnerability

dotCMS is prone to a stored cross-site scripting XSS vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:dotcms:dotcms...

Security update for the Linux Kernel (important)

The openSUSE Leap 42.3 kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service assertion failure, and hypervisor hang or crash via a...

Security update for the Linux Kernel (important)

The openSUSE Leap 42.2 Kernel was updated to 4.4.90 to receive various security and bugfixes. The following security bugs were fixed: - CVE-2017-1000252: The KVM subsystem in the Linux kernel allowed guest OS users to cause a denial of service assertion failure, and hypervisor hang or crash via a...

Live streaming Cryptopals

tl;dr: Im livecoding the Cryptopals in Go on Twitch, one set every Sunday. The recordings are on YouTube. Oh, wow. I love the idea. Would anyone here seriously watch 20 to 40 hours of me doing crypto, math and Go? Mic, screen, and everything. -- Filippo Valsorda @FiloSottile October 16, 2016 Almo...