Glusterfs elevation of privilege vulnerability

Red Hat GlusterFS is an open source distributed file system from Red Hat. The system is a combination of different storage servers , these servers by the Ethernet or unlimited bandwidth technology Infiniband and remote direct memory access RDMA convergence , and ultimately the formation of a larg...

miniSphere Integer Overflow Vulnerability

miniSphere is a lightweight JavaScript-based game engine. An integer overflow vulnerability exists in the 'layerresize' function in the mapengine.c file in miniSphere 5.2.9 and earlier versions. An attacker could exploit this vulnerability to cause a denial of service with the help of a specially...

CVE-2018-5527

On BIG-IP 13.1.0-13.1.0.7, a remote attacker using undisclosed methods against virtual servers configured with a Client SSL or Server SSL profile that has the SSL Forward Proxy feature enabled can force the Traffic Management Microkernel tmm to leak memory. As a result, system memory usage...

USN-3692-2: OpenSSL vulnerabilities

USN-3692-1 fixed a vulnerability in OpenSSL. This update provides the corresponding update for Ubuntu 12.04 ESM. Original advisory details: Keegan Ryan discovered that OpenSSL incorrectly handled ECDSA key generation. An attacker could possibly use this issue to perform a cache-timing attack and...

BSA-2018-620

Security Advisory ID : BSA-2018-620 Component : TLS Revision : 2.0 The TLS protocol 1.2 and earlier supports the rsafixeddh, dssfixeddh, rsafixedecdh, and ecdsafixedecdh values for ClientCertificateType but does not directly document the ability to compute the master secret in certain situations...

glusterfs: access trusted peer group via remote-host command

A flaw was found in glusterfs which can lead to privilege escalation on gluster server nodes. An authenticated gluster client via TLS could use gluster cli with --remote-host command to add it self to trusted storage pool and perform privileged gluster operations like adding other machines to...

WebKitGTK+ Memory Misreference Vulnerability

WebKitGTK+ is a full-featured port of the WebKit rendering engine, a typography engine used to allow web browsers to draw web pages. A memory misreference vulnerability exists in WebCore/platform/graphics/texmap/TextureMapperLayer.cpp in WebKit used in WebKitGTK+. An attacker can exploit this...

Summer SOTI - DDoS by the numbers

Time for a Change The State of the Internet / Security report has been the home for Akamai's research on DDoS, attack traffic and Internet threats for over three years. While the report has evolved and expanded its scope considerably over that time, the content and how it's presented have only se...

kernel: ping socket / AF_LLC connect() sin_family race

A race condition leading to a NULL pointer dereference was found in the Linux kernel's Link Layer Control implementation. A local attacker with access to ping sockets could use this flaw to crash the system...

The vulnerability of the implementation library for the Transport Layer Security protocol of Cisco’s microprogrammable network interface devices allows a attacker to induce a service failure.

The vulnerability of the implementation library for the Transport Layer Security TLS protocol in Cisco’s micro-programmed network interface devices exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures by sending...

Multiple vulnerabilities in the Application Layer Protocol Inspection component of Cisco microprogrammed network interface devices, which allow attackers to cause service failures.

The multiple vulnerabilities of the Application Layer Protocol Inspection component in Cisco microprogrammed network interfaces are related to resource management errors. Exploiting these vulnerabilities could allow a malicious actor to cause service interruptions by sending large amounts of...

Security Bulletin: Vulnerability in IBM Java SDK affects IBM® DB2® LUW (CVE-2015-7575)

Summary There is a vulnerability in IBM® SDK Java™ Technology Edition, Version 6.0 and 7.0 that is used by DB2 LUW. This vulnerability, commonly referred to as “SLOTH”, was disclosed as part of the IBM Java SDK updates in January 2016. Vulnerability Details CVEID: CVE-2015-7575 DESCRIPTION: The T...

Microsoft Windows: Turn on Responder (RSPNDR) driver

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winresponderdriver.nasl 11337 2018-09-11 14:23:53Z emoss $ Check value for Turn on Responder RSPNDR driver Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH, http://www.greenbone.net This program is fr...

Design/Logic Flaw

A vulnerability has been identified in RFID 181EIP All versions, RUGGEDCOM Win V4.4, V4.5, V5.0, and V5.1, SCALANCE X-200 switch family incl. SIPLUS NET variants All versions V5.2.3, SCALANCE X-200IRT switch family incl. SIPLUS NET variants All versions V5.4.1, SCALANCE X-200RNA switch family All...

CVE-2018-4833

Siemens CVE-2018-4833 affects RFID 181-EIP, RUGGEDCOM Win (V4.4–V5.1), SCALANCE X-200/X-IRT/X-200RNA/X-300/X408/X414, and SIMATIC RF182C. Root cause is a heap-based buffer overflow (CWE-122) that allows unprivileged remote attackers in the same L2 network to execute arbitrary code by sending a sp...

UBUNTU-CVE-2018-11574

Improper input validation together with an integer overflow in the EAP-TLS protocol implementation in PPPD may cause a crash, information disclosure, or authentication bypass. This implementation is distributed as a patch for PPPD 0.91, and includes the affected eap.c and eap-tls.c files...

DEBIAN-CVE-2018-7162

All versions of Node.js 9.x and 10.x are vulnerable and the severity is HIGH. An attacker can cause a denial of service DoS by causing a node process which provides an http server supporting TLS server to crash. This can be accomplished by sending duplicate/unexpected messages during the handshak...

Microsoft Windows: Service: Link-Layer Topology Discovery Mapper

This test checks the setting for policy OpenVAS Vulnerability Test $Id: winlinklayertopologydiscoverymapper.nasl 11344 2018-09-12 06:57:52Z emoss $ Check value for Link-Layer Topology Discovery Mapper lltdsvc Authors: Emanuel Moss Copyright: Copyright c 2018 Greenbone Networks GmbH,...

DEBIAN-CVE-2018-0732

During key agreement in a TLS handshake using a DHE based ciphersuite a malicious server can send a very large prime value to the client. This will cause the client to spend an unreasonably long period of time generating a key for this prime resulting in a hang until the client has finished. This...

FAQ: Login performance with Elastic Layers

Why are user logins with Elastic Layers enabled slower than normal logins on a non-EL image? Why are logins slower depending on how many Elastic Layer assignments a user has? Background: When you define an Image Template in the Layering Management Console LMC, you have to select the Elastic...