Logstash 2.3.2 Vulnerability with Netflow codec plugin

Hi all, we've published ESA-2016-06 for a vulnerability in netflow codec plugin for Logstash 2.3.2. Thanks to Jorrit Folmer maintainer of netflow codec for reporting and fixing this issue. Details below: Vulnerability Summary: In Logstash versions prior to 2.3.3, when using the Netflow Codec...

High Performance DoS Analyzer: FastNetMon

High Performance DoS Analyzer FastNetMon – A high performance DoS/DDoS load analyzer built on top of multiple packet capture engines NetFlow, IPFIX, sFLOW, SnabbSwitch, netmap, PFRING, PCAP. What can we do? We can detect hosts in our networks sending or receiving large volumes of...

The vulnerability of the Wireshark Network Protocol Analyzer software allows a remote attacker to compromise the accessibility of protected information.

A vulnerability exists in the dissectv9v10pdudata function within the epan/dissectors/packet-netflow.c file of the Wireshark NetFlow dissector, due to the use of incorrect offset and start values. Exploiting this vulnerability allows malicious actors to cause service failures—such as reading...

[SECURITY] Fedora 23 Update: nfdump-1.6.15-1.fc23

Nfdump is a set of tools to collect and process NetFlow data. It's fast and has a powerful filter pcap like syntax. It supports NetFlow versions v1, v5, v7 , v9 and IPFIX as well as a limited set of sflow. It includes support for CISCO ASA NSEL and CISCO NAT NEL devices which export event logging...

[SECURITY] Fedora 22 Update: nfdump-1.6.15-1.fc22

Nfdump is a set of tools to collect and process NetFlow data. It's fast and has a powerful filter pcap like syntax. It supports NetFlow versions v1, v5, v7 , v9 and IPFIX as well as a limited set of sflow. It includes support for CISCO ASA NSEL and CISCO NAT NEL devices which export event logging...

[SECURITY] Fedora 24 Update: nfdump-1.6.15-1.fc24

Nfdump is a set of tools to collect and process NetFlow data. It's fast and has a powerful filter pcap like syntax. It supports NetFlow versions v1, v5, v7 , v9 and IPFIX as well as a limited set of sflow. It includes support for CISCO ASA NSEL and CISCO NAT NEL devices which export event logging...

Nfdump Nfcapd 1.6.14 - Multiple Vulnerabilities

Nfdump Nfcapd 1.6.14 - Multiple Vulnerabilities , , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Nfdump Nfcapd Multiple Vulnerabilities Affected Versions: Nfdump = 1.6.14 PDF:...

Nfdump Nfcapd 1.6.14 - Multiple Vulnerabilities

Exploit for linux platform in category dos / poc Nfdump Nfcapd Multiple Vulnerabilities Affected Versions: Nfdump = 1.6.14 PDF: http://www.security-assessment.com/files/documents/advisory/Nfdump%20nfcapd%201.6.14%20-%20Multiple%20Vulnerabilities.pdf +-------------+ | Description | +-------------+...

Nfdump Nfcapd 1.6.14 - Multiple Vulnerabilities

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. Nfdump Nfcapd Multiple Vulnerabilities Affected Versions: Nfdump = 1.6.14 PDF:...

CVE-2015-4203

Race condition in Cisco IOS 12.2SCH in the Performance Routing Engine PRE module on uBR10000 devices, when NetFlow and an MPLS IPv6 VPN are configured, allows remote attackers to cause a denial of service PXF process crash by sending malformed MPLS 6VPE packets quickly, aka Bug ID CSCud83396...

Cisco IOS Software UBR Devices IPv6 VPN Multiprotocol Label Switching Denial of Service Vulnerability

A vulnerability in Cisco Universal Broadband Routers performing IPv6 VPN over Multiprotocol Label Switching MPLS; 6VPE and configured for NetFlow could allow an unauthenticated, remote attacker to cause a crash of the Parallel Express Forwarding PXF process on the Performance Routing Engine PRE...

CVE-2015-4418

Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

CVE-2015-2961

Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...

CVE-2015-2960

Cross-site scripting XSS vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-2959

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role...

Design/Logic Flaw

Zoho NetFlow Analyzer build 10250 and earlier does not have an off autocomplete attribute for a password field, which makes it easier for remote attackers to obtain access by leveraging an unattended workstation...

Cross site scripting

Cross-site scripting XSS vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Authorization

Zoho NetFlow Analyzer build 10250 and earlier does not check for administrative authorization, which allows remote attackers to obtain sensitive information, modify passwords, or remove accounts by leveraging the guest role...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Zoho NetFlow Analyzer build 10250 and earlier allows remote attackers to hijack the authentication of administrators...

ZOHO NetFlow Analyzer Incorrectly Setting Unauthorized Access Vulnerability

ZOHO NetFlow Analyzer is a set of network traffic analysis software. The software provides bandwidth monitoring and flow analysis, network forensics and security analysis. A security vulnerability exists in ZOHO NetFlow Analyzer due to the program failing to set the autocomplete attribute of the...