CVE-2020-35609

A denial-of-service vulnerability exists in the asynchronous ioctl functionality of Microsoft Azure Sphere 20.05. A sequence of specially crafted ioctl calls can cause a denial of service. An attacker can write shellcode to trigger this vulnerability...

CVE-2020-35609

CVE-2020-35609 affects Microsoft Azure Sphere 20.05, specifically the asynchronous ioctl path of the /dev/pluton interface. TALOS documents a denial-of-service scenario triggered by a rapid sequence of asynchronous ioctls that fill the Pluton ring buffer, causing the M4/A7 communication to stall ...

CVE-2020-35608

Summary (verified) : CVE-2020-35608 affects Microsoft Azure Sphere 20.07. Affected component: the normal world’s signed code execution path. Root cause : a specially crafted AF_PACKET socket can cause a process to create an executable memory mapping with controllable content. Impact : local code ...

CVE-2020-35608

A code execution vulnerability exists in the normal world’s signed code execution functionality of Microsoft Azure Sphere 20.07. A specially crafted AFPACKET socket can cause a process to create an executable memory mapping with controllable content. An attacker can execute a shellcode that uses...

Microsoft Azure Sphere networkd mdns denial-of-service vulnerability

Summary A denial-of-service vulnerability exists in the networkd mDNS functionality of Microsoft Azure Sphere 20.07. A specific bind call can cause a denial of service, requiring manual recovery. An attacker can bind to port 5353 to trigger this vulnerability. Tested Versions Microsoft Azure Sphe...

AWS, Cisco, and CompTIA Exam Prep — Get 22 Courses for $4.50 Each

You don't need a college degree to get a well-paid job in IT. But technical recruiters do expect to see key certifications on your résumé. If you would like to improve your chances of getting hired, "The 2021 All-In-One AWS, Cisco & CompTIA Super Certification Bundle" is worth your attention. Thi...

Microsoft Azure SDK Security Vulnerability

Microsoft Azure SDK is a code base from Microsoft that supports interaction with programming languages to manage Azure. A security vulnerability exists in Microsoft Azure SDK. The following products and versions are affected:Azure SDK for Java...

KLA12021 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. A security feature bypass vulnerability in Azure SDK for Java can be exploited remotely to...

Microsoft Azure Active Directory again a “Leader” in Gartner Magic Quadrant for Access Management

Howdy folks, I’m proud to announce that for the fourth year in a row, Microsoft Azure Active Directory Azure AD has been recognized as a “Leader” in Gartner Magic Quadrant for Access Management, Worldwide. Earlier this year, my boss, Joy Chik, CVP of Identity Engineering shared Microsoft’s guidin...

IoT security: how Microsoft protects Azure Datacenters

Azure Sphere first entered the IoT Security market in 2018 with a clear mission—to empower every organization on the planet to connect and create secure and trustworthy IoT devices. Security is the foundation for durable innovation and business resilience. Every industry investing in IoT must...

Key layers for developing a Smarter SOC with CyberProof-managed Microsoft Azure security services

This blog post is part of the Microsoft Intelligent Security Association MISA guest blog series. Learn more about MISA here. Security teams are struggling to reduce the time to detect and respond to threats due to the complexity and volume of alerts being generated from multiple security...

Microsoft Azure Sphere Unsigned Code Execution Vulnerability

Azure Sphere is a secure, advanced application platform with built-in communications and security features for connected devices. An unsigned code execution vulnerability exists in Microsoft Azure Sphere versions prior to 20.08. An attacker could exploit the vulnerability to execute code...

Microsoft Azure Sphere Elevation of Privilege Vulnerability (CNVD-2021-17729)

Azure Sphere is a secure, advanced application platform with built-in communications and security features for connected devices. An elevation of privilege vulnerability exists in Microsoft Azure Sphere versions prior to 20.09. An attacker could exploit this vulnerability to gain control of the...

Microsoft Azure Sphere Elevation of Privilege Vulnerability

Azure Sphere is a secure, advanced application platform with built-in communications and security features for connected devices. An elevation of privilege vulnerability exists in Microsoft Azure Sphere versions prior to 20.08. No detailed vulnerability details are provided at this time...

KLA12001 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges, execute arbitrary code, cause denial of service, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

WALinuxAgent bug fix and enhancement update

The Microsoft Azure Linux Agent supports the provisioning and running of Linux virtual machines in the Microsoft Azure cloud. For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

CISO Spotlight: How diversity of data (and people) defeats today’s cyber threats

This year, we have seen five significant security paradigm shifts in our industry. This includes the acknowledgment that the greater the diversity of our data sets, the better the AI and machine learning outcomes. This diversity gives us an advantage over our cyber adversaries and improves our...

Microsoft Azure Elevation of Privilege Vulnerability

Microsoft Azure is an open enterprise-grade cloud computing platform. A security vulnerability exists in the way Microsoft Azure features authenticate access keys, which could be exploited by a remote attacker to submit a special request to invoke an HTTP feature without proper authorization...

KLA11973 Multiple vulnerabilites in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to gain privileges. Below is a complete list of vulnerabilities: 1. An elevation of privilege vulnerability in Network Watcher Agent Virtual Machine Extension for Linux can be exploited...

Microsoft Azure Flaws Open Admin Servers to Takeover

Researchers have disclosed two flaws in Microsoft’s Azure web hosting application service, App Services, which if exploited could enable an attacker to take over administrative servers. Azure App Services is an HTTP-based service for hosting web applications, and is available in both Microsoft...