360 matches found
SCShell
SCShell SCShellは、ChangeServiceConfigAに依存してコマンドを実行するファイルレスな水平移動ツールです。このツールの優れた点は、SMBに対して認証を行わないことです。すべての処理はDCERPCを介して行われます。 このユーティリティは、サービスを登録したり作成したりせずにリモートで使用できます。また、リモートシステムにファイルをドロップする必要もありません（使用する手法に依存します）。 動作の仕組み サービスを作成する代わりに、ChangeServiceConfigA APIを介して単純にリモートでサービスを開き、バイナリパス名を変更します。...
PetitPotam
PetitPotam NTLM リレー攻撃の検出 Petit Potam エクスプロイトを介して NTLM リレー攻撃を誘発しようとする試みの一部を検出するための Zeek パッケージです。 このパッケージは、成功したと思われるエクスプロイトの試みと失敗したと思われる試みの両方を検出します。EFS DCERPC 関数呼び出しの リターンコードを調べることにより、それらを区別します。 注: このパッケージは、暗号化されていない SMB を介して転送されるエクスプロイトの試みのみを検出します。暗号化された SMB 上の DCERPC 呼び出しは検出されません。このような場合、進行中の NTL...
PetitPotam-notest
PetitPotam NTLMリレー攻撃の検出 PetitPotamエクスプロイトを介してNTLMリレー攻撃をトリガーしようとする試みを検出するためのZeekパッケージです。 このパッケージは、成功したと思われるエクスプロイト試行と失敗した試行の両方を検出します。EFS DCERPC関数呼び出しのリターンコードを調べることで、それらを区別します。 注: このパッケージは、暗号化されていないSMB経由で転送されるエクスプロイト試行のみを検出します。DCERPC 暗号化されたSMB経由の呼び出しは検出されません。このような場合、進行中のNTLMリレー攻撃の兆候がないか...
samba: Remote Code Execution in SAMR
A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controlled username is passed without proper...
CVE-2026-31937
Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, inefficiency in DCERPC buffering can lead to a performance degradation. This issue has been patched in version 7.0.15...
CVE-2026-31937 Suricata dcerpc: quadratic complexity in dcerpc buffering
Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, inefficiency in DCERPC buffering can lead to a performance degradation. This issue has been patched in version 7.0.15...
CVE-2026-31937
CVE-2026-31937 affects Suricata (network IDS/IPS/NSM). The issue is an inefficiency in DCERPC buffering that degrades performance, occurring before version 7.0.15. The vulnerability is mitigated by upgrading to Suricata 7.0.15 or later, which patches the DCERPC buffering problem. The CVSS vector ...
CVE-2026-31937
Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, inefficiency in DCERPC buffering can lead to a performance degradation. This issue has been patched in version 7.0.15...
Suricata 安全漏洞
Suricata is a network IDS, IPS, and NSM engine developed by the Open Information Security Foundation. Versions of Suricata prior to 7.0.15 contained security vulnerabilities, which were caused by inefficient DCERPC buffering, potentially leading to performance degradation...
CVE-2026-31937: Inefficient Algorithmic Complexity
Suricata is a network IDS, IPS and NSM engine. Prior to version 7.0.15, inefficiency in DCERPC buffering can lead to a performance degradation. This issue has been patched in version 7.0.15...
SUSE CVE-2026-22258
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB...
CVE-2026-22258
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB...
CVE-2026-22258 Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB...
CVE-2026-22258 Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB...
CVE-2026-22258
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB...
CVE-2026-22258 Suricata DCERPC: unbounded fragment buffering leads to memory exhaustion
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB...
CVE-2026-22258: Uncontrolled Resource Consumption
Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits, leading to memory exhaustion and the process getting killed. While reported for DCERPC over UDP, it is believed that DCERPC over TCP and SMB...
Linux Distros Unpatched Vulnerability : CVE-2026-22258
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, crafted DCERPC traffic can cause Suricata to expand a buffer w/o limits,...
VulnCheck KEV: CVE-2024-37079
Broadcom VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. This could allow a malicious actor with network access to vCenter Server to send specially crafted network packets, potentially leading to remote code execution...
