Paragon Initiative Enterprises: Missing GIT tag/commit verification in Docker

in: https://github.com/paragonie/airship/blob/master/docker/Dockerfile.airshipL14-L16 RUN git clone https://github.com/jedisct1/libsodium.git /tmp/sodium WORKDIR /tmp/sodium RUN git checkout tags/1.0.10 The code is fetched from Github without one of: 1. signature verification on relevant tag. GPG...

The use of Dirty Cow to achieve the docker escape-vulnerability warning-the black bar safety net

Foreword Dirty Cow vulnerability is the use of the Linux kernel in the processing memory write copies Copy-on-Write when the existence conditions of competitive vulnerability, the result can be destruction of private read-only memory mapping. While a low-privileged local user can exploit this...

RHEL 7 : docker (RHSA-2016:2634)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2016:2634 advisory. Docker is an open-source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that will run...

Moderate: Red Hat Security Advisory: docker security and bug fix update

An update for docker is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

docker: privilege escalation via confusion of usernames and UIDs

It was found that Docker would launch containers under the specified UID instead of a username. An attacker able to launch a container could use this flaw to escalate their privileges to root within the launched container...

osquery Command And Control: Kolide

osquery Command And Control Kolide is an agentless osquery web interface and remote api server. Kolide uses the osquery remote apis to do ad-hoc distributed queries, osqueryd configurations and the collection and processing of scheduled queries packs. Kolide was designed to be extremely portable ...

Docker Engine is vulnerable

Docker Engine is a set of lightweight runtime environments and package management tools from Docker, Inc. A security vulnerability exists in Docker Engine version 1.12.2, which stems from an enabled environment condition configured with the wrong condition policy. An attacker can exploit the...

Imgur: Unauthenticated Docker registry

A docker registry was open and unauthenticated, giving access to outdated Imgur source code and secret keys...

CVE-2016-8867

The runc version as used in docker 1.12.2 was incorrectly setting ambient capabilities for all processes executed inside containers. This caused processes of non-root users to run with unexpected privileges, allowing them to escalate their privileges to root...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

Design/Logic Flaw

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

CVE-2016-8867

CVE-2016-8867 affects Docker Engine 1.12.2, where ambient capabilities were enabled due to misconfigured capability policies. This allowed a malicious image to bypass container user permissions and access files in the container filesystem or mounted volumes. The issue is cited across multiple adv...

CVE-2016-8867

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes...

Exploit for Race Condition in Canonical Ubuntu_Linux

dirtycow-docker-vdso This repository is the necessary bits to...

App Container docker2aci Wireless Loop Denial of Service Vulnerability

docker2aci is a set of tools for converting Docker a technology for cross-platform distribution of applications developed in the Go language images into ACIs format. A denial of service vulnerability exists in App Container docker2aci, which can be exploited by an attacker to cause the program to...

WordPress <= 4.6.1 use the theme file to trigger stored XSS vulnerability analysis-vulnerability warning-the black bar safety net

Author: p0wd3r know Chong Yu 4 0 4 Security lab Date: 2016-10-08 0x00 vulnerability overview 1. Vulnerability description WordPress is a PHP and MySQL as a platform free and open source blogging software and content management systems, recently researchers found that in their=4.6.1 version, by...

Free Open Source Self Hosted VirusTotal: Malice

Free Open Source Self Hosted VirusTotal Malice’s mission is to be a free open source version of VirusTotal that anyone can use at any scale from an independent researcher to a fortune 500 company.’ Ubuntu Install: Install Go $ sudo add-apt-repository ppa:ubuntu-lxc/lxd-stable $ sudo apt-get updat...

Drupal 8 configuration file download vulnerability analysis-vulnerability warning-the black bar safety net

Author: p0wd3r know Chong Yu 4 0 4 Security lab Date: 2016-09-22 0x00 vulnerability overview 1. Vulnerability description Drupal （ https://www.drupal.org is a free open source content management system, recent researchers have found in it 8. x 8.1.10 version found three security vulnerabilities,...