CVE-2017-2343

The Integrated User Firewall UserFW feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of user profiles on top of the existing firewall polices. As part of an internal security review of the UserFW services authentication API,...

Hardcoded credentials

The Integrated User Firewall UserFW feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of user profiles on top of the existing firewall polices. As part of an internal security review of the UserFW services authentication API,...

CVE-2017-2343

CVE-2017-2343 affects Juniper Junos SRX Series with the Integrated User Firewall (UserFW) authentication API. The root cause is hardcoded credentials in UserFW, enabling an unauthenticated, remote attacker to potentially gain administrative access to the SRX device and compromise connected servic...

CVE-2017-2343 SRX Series: Hardcoded credentials in Integrated UserFW feature.

The Integrated User Firewall UserFW feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integration of user profiles on top of the existing firewall polices. As part of an internal security review of the UserFW services authentication API,...

Fedora Update for bind-dyndb-ldap FEDORA-2017-001f135337

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Virtuozzo 7 : httpd / httpd-devel / httpd-manual / httpd-tools / etc (VZLSA-2017-0906)

An update for httpd is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

NTLM, LDAP&RDP Relay vulnerability analysis-vulnerability warning-the black bar safety net

Over the past few months, the Preempt research team found and reported two of Microsoft's NT LAN Manager NTLM vulnerability. These vulnerabilities have the same problem, IE NTLM does not correctly handle two different protocols. These issues are very important, because even turn on LDAP server...

Fedora 24 : 32:bind / bind-dyndb-ldap / dnsperf (2017-001f135337)

Update back to ISC supported version. Security fix for CVE-2017-3143, CVE-2017-3142, CVE-2017-3140 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as...

Juniper Networks Junos OS SRX Series: Hardcoded Credentials Vulnerability

Junos OS on SRX series contain hardcoded credentials. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:juniper:junos"; if...

[SECURITY] Fedora 24 Update: bind-dyndb-ldap-10.1-2.fc24

This package provides an LDAP back-end plug-in for BIND. It features support for dynamic updates and internal caching, to lift the load off of your LDAP server...

Critical Flaws Found in Windows NTLM Security Protocol – Patch Now

As part of this month's Patch Tuesday, Microsoft has released security patches for a serious privilege escalation vulnerability which affect all versions of its Windows operating system for enterprises released since 2007. Researchers at behavioral firewall specialist Preempt discovered two...

Microsoft Addresses NTLM Bugs That Facilitate Credential Relay Attacks

NTLM has a long history of serious vulnerabilities and of causing anxiety for Windows and UNIX server admins. Their collective angst is unlikely to lessen today with the disclosure of a pair of new vulnerabilities in the protocol suite. Microsoft today patched one of the issues among its Patch...

Windows Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully forward an authentication request to a Windows LDAP server, such as a system running Active Directory Domain Services AD DS or Active Directory Lightweight Directory...

Security update for the Windows elevation of privilege vulnerability in Windows Server 2008: July 11, 2017

Security update for the Windows elevation of privilege vulnerability in Windows Server 2008: July 11, 2017 Summary An elevation of privilege vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully forward an authentication request to a Windows LDAP...

FAQ: Password change over LDAP on Read Only Domain Controller Servers

Question : Can customer change password over LDAP when using Read only Domain controller RODC? Answer : Password change is not possible on RODC servers. Note: We support referrals only for group extraction, it might not be applicable for password resets. For information on password change in a...

Debian DLA-1019-1 : phpldapadmin security update

It was discovered that there was a cross-site scripting XSS vulnerability in phpldapadmin, a web-based interface for administering LDAP servers. For Debian 7 'Wheezy', this issue has been fixed in phpldapadmin version 1.2.2-5+deb7u1. We recommend that you upgrade your phpldapadmin packages. NOTE:...

CVE-2017-4976

EMC ESRS Policy Manager prior to 6.8 contains an undocumented account OpenDS admin with a default password. A remote attacker with the knowledge of the default password may login to the system and gain administrator privileges to the local LDAP directory server...

Default credentials

EMC ESRS Policy Manager prior to 6.8 contains an undocumented account OpenDS admin with a default password. A remote attacker with the knowledge of the default password may login to the system and gain administrator privileges to the local LDAP directory server...

CVE-2017-4976

EMC ESRS Policy Manager prior to 6.8 contains an undocumented account OpenDS admin with a default password. A remote attacker with the knowledge of the default password may login to the system and gain administrator privileges to the local LDAP directory server...

CVE-2017-4976

EMC ESRS Policy Manager before version 6.8 contains an undocumented OpenDS admin account with a default password. A remote attacker who knows the default password can log in and gain administrator privileges on the local LDAP server. A remediation is available in EMC Security Remote Services Poli...