[slackware-security] ruby

New ruby packages are available for Slackware 14.2 and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/ruby-2.2.9-i586-1slack14.2.txz: Upgraded. This update fixes a security issue: Net::FTPget, getbinaryfile, gettextfile, put,...

Threat Outbreak Alert RuleID31560: Email Messages Distributing Malicious Software on December 7, 2017

Medium Alert ID: 56191 First Published: 2017 December 7 20:36 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID31560 may contain the following files: Name |...

Recognizing and Avoiding Disassembled Junk

There is a common annoyance that seems to plague every reverse engineer and incident responder at some point in their career: wasting time or energy looking at junk code. Junk code is a sequence of bytes that you have disassembled that are not actual instructions executed as part of a program. In...

Exploit for Unrestricted Upload of File with Dangerous Type in Apache Tomcat

CVE-2017-12615 Tomcat 远程代码执行漏洞 Exploit java -jar CVE-2017-12...

[SECURITY] Fedora 26 Update: mediawiki-1.28.3-1.fc26

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

Microsoft Edge Chakra JIT - Type Confusion with switch Statements Exploit

Exploit for windows platform in category dos / poc / Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=1341&desc=3 Let's start with a switch statement and its IR code for JIT. JS: for let i = 0; i ; 100; i++ switch i case 2: case 4: case 6: case 8: case 10: case 12: case 14: case...

How to Defragment a PVS vDisk with minimum downtime

The purpose of this guide is to instruct a PVS Administrator on the quickest way to perform a defragmentation process on a vDisk, while minimizing the amount of downtime incurred for the PVS Targets. It is important to note that, while this process can be performed without having to Power Down th...

[slackware-security] openssl

New openssl packages are available for Slackware 14.2 and -current to fix a security issue. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/openssl-1.0.2m-i586-1slack14.2.txz: Upgraded. This update fixes a security issue: There is a carry propagating bug in the x64...

Configure Citrix Profile Management through WEM

Instruct engineers in how to configure citrix profile management through WEM...

CVE-2017-12173

It was found that sssd's sysdbsearchuserbyupnres function did not sanitize requests when querying its local cache and was vulnerable to injection. In a centralized login environment, if a password hash was locally cached for a given user, an authenticated attacker could use this flaw to retrieve...

UPDATE: WarBerryPi Version 5.1b!

PenTestIT RSS Feed My last post pertaining to this Red Teaming Hardware Implant was about an updated version. This post also covers the changes made to two versions since my last post about the WarBerryPi v5. We now have an updated release for the Raspberry Pi based hardware implant allowing you ...

Windows Packet Divert: WinDivert

Windows Packet Divert WinDivert is a user-mode packet capture-and-divert package for Windows Vista, Windows 2008, Windows 7, Windows 8 and Windows 10. WinDivert allows usermode programs to capture/modify/drop network packets sent to/from the Windows network stack. In summary, WinDivert can captur...

Pharos: A Static Binary Analysis Framework

PenTestIT RSS Feed All of us know what static binary analysis means. It means that the analysis of the binary is performed without actually executing it. Almost two years ago, an open source framework - Pharos, was created by the Carnegie Mellon SEI, CERT Division in collaboration with the Lawren...

Udp2raw-tunnel - A UDP Tunnel which tunnels UDP via FakeTCP/UDP/ICMP Traffic by using Raw Socket [Bypass UDP FireWalls]

A UDP Tunnel which tunnels UDP via FakeTCP/UDP/ICMP Traffic by using Raw Socket, helps you Bypass UDP FireWalls or Unstable UDP Environment. Its Encrypted, Anti-Replay and Multiplexed.It also acts as a Connection Stabilizer. Support Platforms A Linux host including desktop Linux, Android...

CWA for Windows: How to disable Citrix Receiver from popping up during logon to the Desktop.

This article is intended for Citrix administrators and technical teams only.Non-admin users must contact their company’s Help Desk/IT support team and can refer toCTX297149for more information How to disable Citrix Receiver from popping up during logon to the Desktop...

How to change management IP of SVM from LOM

Change the SDX Management Service SVM IP via the LOM when network access to SVM IP and XenServer Hypervisor is not available...

App Layering: Getting AppSense and WebSense to work

You may find that AppSense is not personalizing applications properly or otherwise not functioning. Here are the directions for installing AppSense and/or WebSense in a layer,...

libjpeg-turbo 1.5.1 - Denial of Service

libjpeg-turbo 1.5.1 - Denial of Service libjpeg-turbo denial of service vulnerability ====================== Author : qflb.wu CVE : CVE-2017-9614 ====================== Introduction: ============= libjpeg-turbo is a JPEG image codec that uses SIMD instructions MMX, SSE2, AVX2, NEON, AltiVec to...

libjpeg-turbo 1.5.1 - Denial of Service

libjpeg-turbo denial of service vulnerability ====================== Author : qflb.wu CVE : CVE-2017-9614 ====================== Introduction: ============= libjpeg-turbo is a JPEG image codec that uses SIMD instructions MMX, SSE2, AVX2, NEON, AltiVec to accelerate baseline JPEG compression and...

libjpeg-turbo 1.5.1 - Denial of Service Vulnerability

Exploit for linux platform in category dos / poc libjpeg-turbo denial of service vulnerability ====================== Author : qflb.wu CVE : CVE-2017-9614 ====================== Introduction: ============= libjpeg-turbo is a JPEG image codec that uses SIMD instructions MMX, SSE2, AVX2, NEON,...