CVE-2017-9812

CVE-2017-9812 affects Kaspersky Anti-Virus for Linux File Server. The web UI’s getReportStatus endpoint accepts a reportId that can be abused via directory traversal to read arbitrary files with the kluser privileges. Core Security and related advisories corroborate a path traversal vulnerability...

CVE-2017-9811: Improper Input Validation

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. By abusing the quarantine read and write operations, it is possible to elevate the privileges to root...

CVE-2017-9810: Cross-Site Request Forgery (CSRF)

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

CVE-2017-9812: Exposure of Sensitive Information to an Unauthorized Actor

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312 to read arbitrary files with kluser privileges...

CVE-2017-9813: Improper Neutralization of Input During Web Page Generation

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312, the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting XSS...

Kaspersky Anti-Virus for Linux File Server Elevation of Privilege Vulnerability

Kaspersky Anti-Virus for Linux File Server is designed to provide antivirus protection for file servers running under the Linux operating system. An elevation of privilege vulnerability exists in Kaspersky Anti-Virus for Linux File Server. The vulnerability allows attackers to exploit an elevatio...

Kaspersky Anti-Virus for Linux File Server Cross-Site Request Forgery Vulnerability

Kaspersky Anti-Virus for Linux File Server is designed to provide antivirus protection for file servers running under the Linux operating system. A cross-site request forgery vulnerability exists in Kaspersky Anti-Virus for Linux File Server. This allows an attacker to submit authenticated reques...

Kaspersky Anti-Virus for Linux File Server Path Traversal Vulnerability

Kaspersky Anti-Virus for Linux File Server is designed to provide antivirus protection for file servers running under the Linux operating system. A path traversal vulnerability exists in Kaspersky Anti-Virus for Linux File Server. The vulnerability allows an attacker to read arbitrary files with...

Kaspersky Anti-Virus for Linux File Server Reflective Cross-Site Scripting Vulnerability

Kaspersky Anti-Virus for Linux File Server is designed to provide antivirus protection for file servers running under the Linux operating system. A reflected cross-site scripting vulnerability exists in Kaspersky Anti-Virus for Linux File Server. The vulnerability allows an attacker to execute...

Kaspersky Anti-Virus File Server 8.0.3.297 XSS / CSRF / Code Execution

Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Advisory URL: http://www.coresecurity.com/advisories/Kaspersky-Anti-Virus-File-Server-Multiple-Vulnerabilities Date published: 2017-06-28 Date of last update: 2017-06-28 Vendors...

Kaspersky Anti-Virus File Server Multiple Vulnerabilities

Advisory ID Internal CORE-2017-0003 1. Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Date published: 2017-06-28 Date of last update: 2017-06-28 Vendors contacted: Kaspersky Release mode: Forced release 2. Vulnerability...

Kaspersky Anti-Virus File Server 8.0.3.297 - Multiple Vulnerabilities

Advisory Information Title: Kaspersky Anti-Virus File Server Multiple Vulnerabilities Advisory ID: CORE-2017-0003 Advisory URL: http://www.coresecurity.com/advisories/Kaspersky-Anti-Virus-File-Server-Multiple-Vulnerabilities Date published: 2017-06-28 Date of last update: 2017-06-28 Vendors...

The vulnerability in the web console of the Antivirus Kasper’s 8.0 anti-virus software for Linux File Servers allows access to files located on the server.

The vulnerability of the Antivirus Kaspersky 8.0 web console for Linux File Servers relates to the possibility of executing operating system commands. Exploiting this vulnerability allows a malicious actor to gain access to files located on the server by sending a specially crafted GET request wi...

WikiLeaks Dumps CIA Patient Zero Windows Implant

WikiLeaks on Thursday made public a CIA implant that is used to turn a Windows file server into a malware distribution point on the local network. The documents describing the tool, Pandemic, explain how remote machines on the local network trying to download and-or execute documents from the fil...

May 9, 2017—KB4019216 (Monthly Rollup)

None None...

Analysis of Kerberos constrained delegation SPN security vulnerabilities-vulnerability warning-the black bar safety net

In the past few years, more and more security researchers began to study Kerberos security, eventually found in support of the authentication Protocol of the network environment a lot of interesting attacks. In this post, I will describe my in the Windows Kerberos constrained delegation feature...

March 14, 2017—KB4012606 (OS Build 10240.17319)

None None...

CVE-2017-6100

tcpdf before 6.2.0 uploads files from the server generating PDF-files to an external FTP...

June 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2

June 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 This update rollup is superseded by July 2016 update rollup for Windows RT 8.1, Windows 8.1, and Windows Server 2012 R2 KB3172614 that was released on July 21, 2016. The June 2016 update rollup for Windows RT 8.1,...

CVE-2016-4025

Avast Internet Security v11.x.x, Pro Antivirus v11.x.x, Premier v11.x.x, Free Antivirus v11.x.x, Business Security v11.x.x, Endpoint Protection v8.x.x, Endpoint Protection Plus v8.x.x, Endpoint Protection Suite v8.x.x, Endpoint Protection Suite Plus v8.x.x, File Server Security v8.x.x, and Email...