Security Bulletin: Reuse of Source Port in DataPower DNS queries (CVE-2017-1773)

Summary IBM DataPower Gateway may re-use the source port in DNS lookups. IBM has addressed the applicable CVE Vulnerability Details Relevant CVE Information: CVEID: CVE-2017-1773 DESCRIPTION: IBM WebSphere DataPower Appliances could allow an attacker using man-in-the-middle techniques to spoof DN...

2017 in Snort Signatures.

This post was written by Martin Lee and Vanja Svajcer. 2017 was an eventful year for cyber security with high profile vulnerabilities that allowed self-replicating worm attacks such as WannaCry and BadRabbit to impact organizations throughout the world. In 2017, Talos researchers discovered many...

CVE-2017-12130

An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library dereference a NULL pointer leading to a server crash and denial of service. An attacker needs to send a DNS query to trigger this vulnerabili...

CVE-2017-12130

An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library dereference a NULL pointer leading to a server crash and denial of service. An attacker needs to send a DNS query to trigger this vulnerabili...

CVE-2017-12130

An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library dereference a NULL pointer leading to a server crash and denial of service. An attacker needs to send a DNS query to trigger this vulnerabili...

Null pointer dereference

An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library dereference a NULL pointer leading to a server crash and denial of service. An attacker needs to send a DNS query to trigger this vulnerabili...

CVE-2017-12130

An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library dereference a NULL pointer leading to a server crash and denial of service. An attacker needs to send a DNS query to trigger this vulnerabili...

Tinysvcmdns Multi-label DNS mdns_parse_qn Denial Of Service Vulnerability

Summary An exploitable NULL pointer dereference vulnerability exists in the tinysvcmdns library version 2017-11-05. A specially crafted packet can make the library dereference a NULL pointer leading to server crash and denial of service. An attacker needs to send a DNS query to trigger this...

PowerDNS Recursor Improper Parameter Handling Remote Code Execution (CVE-2017-15092)

A remote code execution vulnerability exists in PowerDNS. The vulnerability is due to insufficient user input validation of a DNS query.A remote attacker can exploit this weakness to execute arbitrary code in the affected DNS server...

CVE-2017-10874

PWR-Q200 does not use random values for source ports of DNS query packets, which allows remote attackers to conduct DNS cache poisoning attacks...

CVE-2017-10874

The CVE-2017-10874 issue affects PWR-Q200, a mobile WiFi router by NTT East. The root cause is that DNS queries are sent with fixed (non-random) source ports (CWE-330), enabling remote attackers to perform DNS cache poisoning. Impact stated in sources: spoofed DNS responses could mislead devices ...

Cesanta Mongoose DNS Query Compressed Name Pointer Denial Of Service

Summary An infinite loop programming error exists in the DNS server functionality of Cesanta Mongoose 6.8 library. A specially crafted DNS request can cause an infinite loop resulting in high CPU usage and Denial Of Service. An attacker can send a packet over network to trigger this vulnerability...

‘BadRabbit’ Ransomware Burrows Into Russia, Ukraine

ARCHIVED STORY ‘BadRabbit’ Ransomware Burrows Into Russia, Ukraine By Raj Samani · October 24, 2017 This post was researched and written by Tim Hux, David Marcus, Charles McFarland, Douglas McKee, and Raj Samani. McAfee is currently investigating a ransomware campaign known as BadRabbit, which...

Updated dnsmasq packages fix security vulnerabilities

An audit by mozilla security found several vulnerability and potential vulnerability in dnsmasq: - Uninitialized buffer leads to memory leakage - Allocated memory is not cleared - Unchecked return value can lead to NULL pointer dereference - Hardcoded values in fscanf format strings with...

MGASA-2017-0367 Updated dnsmasq packages fix security vulnerabilities

An audit by mozilla security found several vulnerability and potential vulnerability in dnsmasq: - Uninitialized buffer leads to memory leakage - Allocated memory is not cleared - Unchecked return value can lead to NULL pointer dereference - Hardcoded values in fscanf format strings with aliased...

FreeBSD : dnsmasq -- multiple vulnerabilities (b77b5646-a778-11e7-ac58-b499baebfeaf)

Google Project Zero reports : - CVE-2017-14491: Heap based overflow 2 bytes. Before 2.76 and this commit overflow was unrestricted. - CVE-2017-14492: Heap based overflow. - CVE-2017-14493: Stack Based overflow. - CVE-2017-14494: Information Leak - CVE-2017-14495: Lack of free - CVE-2017-14496:...

dnsmasq -- multiple vulnerabilities

Google Project Zero reports: CVE-2017-14491: Heap based overflow 2 bytes. Before 2.76 and this commit overflow was unrestricted. CVE-2017-14492: Heap based overflow. CVE-2017-14493: Stack Based overflow. CVE-2017-14494: Information Leak CVE-2017-14495: Lack of free CVE-2017-14496: Invalid boundar...

cFire: IP Discovery for Domains behind Cloudflare

PenTestIT RSS Feed If you remember, I blogged about a CloudFail and HatCloud earlier. Those tools help you find the IP addresses of systems that are protected/behind Cloudflare. This post is about a new tool on the block - cFire, which just does not stop at detecting the systems restricted using...

Why does Citrix Receiver send DNS query for nonexistent hostname?

This article is intended for Citrix administrators and technical teams only. Non-admin users must contact their company's Help Desk/IT support team and can refer to CTX297149 for more information. Question: Why does Citrix Receiver send DNS queries to similar NonExistingSubDomain? Answer: Citrix...

Information disclosure

DNS client in Microsoft Windows 8.1; Windows Server 2012 R2, Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 fails to properly process DNS queries, which allows remote attackers to obtain sensitive information via 1 convincing a workstation user to visit an untrusted...