Microsoft Azure Cloud Instance Detection

Binary data 700395.prm...

Announcing the Microsoft Azure DevOps Bounty program

The Microsoft Security Response Center MSRC is pleased to announce the launch of the Azure DevOps Bounty program, a program dedicated to providing rock-solid security for our DevOps customers. Starting January 17, 2019, we’re excited to offer rewards up to US$20,000 for eligible vulnerabilities i...

USN-3847-3: Linux kernel (Azure) vulnerabilities

USN-3847-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. This update provides the corresponding updates for the Linux kernel for Microsoft Azure Cloud systems for Ubuntu 14.04 LTS. It was discovered that a race condition existed in the raw MIDI driver for the Linux kernel, leadi...

Persistent XSRF on Kubernetes Dashboard using Redhat Keycloak Gatekeeper on Microsof Azure

tl;dr I found an XSRF in the OAuth implementation of Redhat Keycloak Gatekeeper. This would be a bit worse for people using Gatekeeper to protect their Kubernetes Dashboard especially in Microsof Azure. The Issue in Keycloak Gatekeeper Keycloak Gatekeeper is an OpenID Proxy service for Keycloak, ...

KLA11883 ACE vulnerability in Microsoft Azure

A cross-site-scripting XSS vulnerability was found in Microsoft Azure. Malicious users can exploit this vulnerability to execute arbitrary code. Original advisories CVE-2018-8652 Related products Microsoft-Windows Microsoft-Azure CVE list CVE-2018-8652 warning KB list 4480788 Solution Install...

KLA11887 XSS vulnerability in Microsoft Azure

A cross-site-scripting XSS vulnerability was found in in MIcrosoft Azure. Malicious users can exploit this vulnerability to spoof user interface. Original advisories CVE-2018-8600 Related products Microsoft-Azure CVE list CVE-2018-8600 high KB list Solution Install necessary updates from the KB...

Microsoft Azure App Service CVE-2018-8600 Cross Site Scripting Vulnerability

Description Microsoft Azure App Service is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This...

Innovative Phishing Tactic Makes Inroads Using Azure Blob

A fresh tactic for phishing Office 365 users employs credential-harvesting forms hosted on Azure Blob storage – signed with legitimate Microsoft SSL certificates to lend an air of legitimacy. Azure Blob Storage is a cloud storage solution for hosting unstructured data such as images, video or tex...

Microsoft Azure IoT Device Client SDK Remote Memory Corruption Vulnerability

Microsoft C SDK for Azure IoT is a C-based software development kit for developing Azure IoT Internet of Things platform applications from Microsoft. A remote memory corruption vulnerability exists in the Microsoft Azure IoT Device Client SDK. An attacker can exploit this vulnerability to execute...

Microsoft Azure IoT Device Client SDK CVE-2018-8531 Remote Memory Corruption Vulnerability

Description Microsoft Azure IoT Device Client SDK is prone to a remote memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial of service conditions. Technologies Affected Microsof...

Server Spoofing

Microsoft.Azure.IoTHub.IoTHubClient is vulnerable to server spoofing. The library does not enforce HTTP certificates properly, allowing a malicious user conducting a Man-in-the-Middle MitM attack to impersonate the server...

Microsoft Azure IoT SDK CVE-2018-8479 Spoofing Vulnerability

Description Microsoft Azure IoT SDK is prone to a security vulnerability that may allow attackers to conduct spoofing attacks. Successful exploits may allow attackers to perform man-in-the-middle attacks or impersonate server, which will aid in further attacks. Technologies Affected Microsoft C S...

Granular permissions for Microsoft Azure user

Challenge When adding an Azure account to Veeam Backup & Replication, you would use the Add Microsoft Azure compute account... then, on the Subscription tab of the wizard that opens, select the "Create a new account" option. Doing this will register a new Azure AD Application. The account used to...

USN-3718-1: Linux kernel regression

USN-3695-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04 LTS. Unfortunately, the fix for CVE-2018-1108 introduced a regression where insufficient early entropy prevented services from starting, leading in some situations to a failure to boot, This update addresses the issue. We...

USN-3695-1: Linux kernel vulnerabilities

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly initialize the crc32c checksum driver. A local attacker could use this to cause a denial of service system crash. CVE-2018-1094 It was discovered that the cdrom driver in the Linux kernel contained an...

Release Notes for Veeam Backup & Replication 9.5 Update 3a

More Recent Version Available Please find the latest version of Veeam Backup & Replication here: Veeam Downloads - Latest Version Challenge Release Notes for Veeam Backup Replication 9.5 Update 3a Cause Please confirm that you are running version 9.5.0.580, 9.5.0.711, 9.5.0.802, 9.5.0.823,...

USN-3678-3: Linux kernel (Azure) vulnerabilities

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle corrupted meta data in some situations. An attacker could use this to specially craft an ext4 file system that caused a denial of service system crash when mounted. CVE-2018-1092 It was discovere...

USN-3678-2: Linux kernel (Azure) vulnerabilities

Wen Xu discovered that the ext4 filesystem implementation in the Linux kernel did not properly handle corrupted meta data in some situations. An attacker could use this to specially craft an ext4 file system that caused a denial of service system crash when mounted. CVE-2018-1092 It was discovere...

Multiple Microsoft Azure IoT SDKs CVE-2018-8119 Man in the Middle Spoofing Vulnerability

Description Multiple Microsoft Azure IoT SDKs are prone to a security vulnerability that may allow attackers to conduct spoofing attacks. A man-in-the-middle attacker can exploit this issue to conduct spoofing attacks and perform unauthorized actions; other attacks are also possible. Technologies...

Qualys: Cloud Security Must Move Towards ‘Transparent Orchestration’

What does the “My Little Pony” television series and cyber security have in common? Ask Qualys Chief Product Officer Sumedh Thakar. Whenever his 7-year old daughter wanted to see an episode of this show, the process involved multiple steps: Turning on the smart TV, scrolling through the app menu,...