Q3 2017 Global DDoS Threat Landscape Report

Today we are releasing our latest Global DDoS Threat Landscape Report, a statistical analysis of 5,765 network and application layer DDoS attacks mitigated by Imperva Incapsula services during Q3 2017. Before diving into the report’s highlights, it should be mentioned that this quarter was marked...

Error: "ProcessAttribute: failed getting 135292-byte attribute"- When Copying Folders Recursively

The import task will fail with this: The CachePoint Appliance could not import the gold image VM to create the Operating System Layer. Error is: Failed to copy folders recursively. Details: Note there are other reasons you could have a failure to copy files recursively.Always check UniSysLibLog f...

Cisco Jabber for Windows Information Disclosure Vulnerability (CNVD-2017-36124)

Cisco Jabber for Windows is the United States Cisco Cisco company's set of unified communications client solutions for the Windows platform. The program provides online status display, instant messaging, voice and other functions. An information disclosure vulnerability exists in Cisco Jabber for...

CVE-2017-15114

When libvirtd is configured by OSP director tripleo-heat-templates to use the TLS transport it defaults to the same certificate authority as all non-libvirtd services. As no additional authentication is configured this allows these services to connect to libvirtd which is equivalent to root acces...

How to force HTTPS on the ELM

Many customers have security requirements mandating the use of https. There is no way within the management console of the Enterprise Layer Manager to force https, so Engineering has approved this as the officially supported method to configure the appliance to be https-only...

CVE-2017-8213

Huawei SMC2.0 with software of V100R003C10, V100R005C00SPC100, V100R005C00SPC101B001T, V100R005C00SPC102, V100R005C00SPC103, V100R005C00SPC200, V100R005C00SPC201T, V500R002C00, V600R006C00 has an input validation vulnerability when handle TLS and DTLS handshake with certificate. Due to the...

CVE-2017-8157

OceanStor 5800 V3 with software V300R002C00 and V300R002C10, OceanStor 6900 V3 V300R001C00 has an information leakage vulnerability. Products use TLS1.0 to encrypt. Attackers can exploit TLS1.0's vulnerabilities to decrypt data to obtain sensitive information...

SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)

A flaw was found in the way the DES/3DES cipher was used as part of the TLS/SSL protocol. A man-in-the-middle attacker could use this flaw to recover some plaintext data by capturing large amounts of encrypted traffic between TLS/SSL server and client if the communication used a DES/3DES based...

httpd: mod_ssl NULL pointer dereference

A NULL pointer dereference flaw was found in the httpd's modssl module. A remote attacker could use this flaw to cause an httpd child process to crash if another module used by httpd called a certain API function during the processing of an HTTPS request...

CVE-2017-14388

Cloud Foundry Foundation GrootFS release 0.3.x versions prior to 0.30.0 do not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker to provide an image layer that GrootFS would consider to be the Ubuntu base layer...

Creation of Platform Layer fails with a time out error from Vsphere

During creation of Platform layer, Task fails and we get an error on the App layering console as "A timeout occurred waiting for a vsphere task to complete"...

CVE-2017-14388: GrootFS doesn't validate DiffIDs | Cloud Foundry

Severity High Vendor Cloud Foundry Foundation Affected Cloud Foundry Products and Versions GrootFS release 0.3.x versions prior to 0.30.0 Description GrootFS does not validate DiffIDs, allowing specially crafted images to poison the grootfs volume cache. For example, this could allow an attacker ...

CVE-2017-2913

An exploitable vulnerability exists in the filtering functionality of Circle with Disney. SSL certificates for specific domain names can cause the Bluecoat library to accept a different certificate than intended. An attacker can host an HTTPS server with this certificate to trigger this...

USN-3475-1: OpenSSL vulnerabilities

It was discovered that OpenSSL incorrectly parsed the IPAddressFamily extension in X.509 certificates, resulting in an erroneous display of the certificate in text format. CVE-2017-3735 It was discovered that OpenSSL incorrectly performed the x8664 Montgomery squaring procedure. While unlikely, a...

[SECURITY] [DSA 4018-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4018-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso November 04, 2017 https://www.debian.org/security/faq -...

The vulnerability of the Audio Hardware Abstraction Layer interface of the Media Framework component in the Android operating system allows a hacker to increase their privileges.

The vulnerability of the Audio Hardware Abstraction Layer HAL component of the Android operating system’s Media Framework is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

CVE-2017-12273

A vulnerability in 802.11 association request frame processing for the Cisco Aironet 1560, 2800, and 3800 Series Access Points could allow an unauthenticated, Layer 2 radio frequency RF adjacent attacker to cause the Access Point AP to reload, resulting in a denial of service DoS condition. The...

CVE-2017-1000122

The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service release assertion of the UI process. This vulnerability does not affect Apple products...

CVE-2017-1000122

The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service release assertion of the UI process. This vulnerability does not affect Apple products...

CVE-2017-1000122

CVE-2017-1000122 affects WebKitGTK+ (WebKit) prior to 2.16.3. The UNIX IPC layer fails to properly validate certain message metadata, allowing a compromised secondary process to cause a denial of service (release assertion) in the UI process. This does not affect Apple products. A remediation is ...