Time to Eliminate Traditional VPNs

It is time to stop trusting your endpoints implicitly and reduce the complexity and risk associated with traditional VPN access and flat networks. Varied digital ecosystems, cloud migration, and workforce mobility have created a climate where the network perimeter no longer exists. This is eviden...

Asset Inventory for Network Perimeter: from Declarations to Active Scanning

In the previous post, I shared some of my thoughts about the good Asset Inventory system. Of course, for me as a Security Specialist, it would be great if IT will provide such magical system. But such an ideal situation is rarely possible. So now let's see how to build an Asset Inventory system...

Covert Data Channel in TLS Dodges Network Perimeter Protection

Researchers have released a proof-of-concept framework for a new covert channel for data exchange using the Transport Layer Security TLS protocol. The method exploits the public key certificate standard X.509 and could allow for post-intrusion C2 communication and data exfiltration to go unnotice...

New Nessus 7 Professional and the end of cost-effective Vulnerability Management (as we knew it)

It's an epic and really sad news. When people asked me about the cost-effective solution for Vulnerability Management I usually answered: "Nessus Professional with some additional automation through Nessus API". With just a couple of Nessus Professional scanning nodes it was possible to scan all...

Vulnerability Management for Network Perimeter

Network Perimeter is like a door to your organization. It is accessible to everyone and vulnerability exploitation does not require any human interactions, unlike, for example, phishing attacks. Potential attacker can automate most of his actions searching for an easy target. It's important not t...

Microsoft Windows Hyper-V CVE-2017-0169 Information Disclosure Vulnerability

Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Windows 8.1 for x64-based Systems Microsoft Windows Server 2012 Microsoft...

Microsoft Windows CVE-2016-0018 DLL Loading Remote Code Execution Vulnerability

Description Microsoft Windows is prone to a remote code-execution vulnerability. An attacker can leverage this issue to execute arbitrary code in the context of the currently logged-in user. Failed exploit attempts will result in a denial-of-service condition. Technologies Affected Microsoft...

Kerio Control 8.6.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications Title: Multiple Vulnerabilities in Kerio Control Virtual Appliance Vulnerabilities: SQL Injection, Remote Code Execution through CSRF Product: Kerio Control Homepage: http://www.kerio.com Affected Version: = 8.6.1 Fixed Version: 8.6.2 partiall...

Kerio Control 8.6.1 SQL Injection / Code Execution / CSRF

IntelliSec Security Advisory ============================================================================================== Title: Multiple Vulnerabilities in Kerio Control Virtual Appliance Vulnerabilities: SQL Injection, Remote Code Execution through CSRF Product: Kerio Control Homepage:...

Microsoft Windows browser election message kernel pool overflow

Overview A vulnerability exists in the way the Microsoft Windows browser service handles Browser Election messages. Description From Description of the Microsoft Computer Browser Service:"The browser service maintains a list of the domain name or workgroup name the computer is in, and the protoco...

Microsoft Windows DNS RPC buffer overflow

Overview The Microsoft DNS service Remote Procedure Call RPC implementation contains a stack buffer overflow. This vulnerability may allow a remote attacker to execute arbitrary code with SYSTEM privileges. Description The Microsoft Windows DNS service uses RPC to facilitate remote management. Th...

Microsoft Windows animated cursor stack buffer overflow

Overview Microsoft Windows contains a stack buffer overflow in the handling of animated cursor files. This vulnerability may allow a remote attacker to execute arbitrary code or cause a denial-of-service condition. Description Animated cursor files .ani contain animated graphics for icons and...

Sun Solaris fails to properly process ICMP packets

Overview Sun Solaris fails to properly handle ICMP packets, which may allow a remote, unauthenticated attacker to cause a denial of service. Description Sun Solaris 10 contains an unspecified error that can cause a system panic when handling a specially crafted ICMP packet. Note that Solaris 8 an...

CA BrightStor ARCserve Backup Message Engine RPC buffer overflow

Overview The Computer Associates BrightStor ARCserve Backup Message Engine contains a buffer overflow vulnerability. If successfully exploited, this vulnerability may allow a remote attacker to execute arbitrary code. Description BrightStor ARCserve Backup is a backup and data retention tool that...

eIQnetworks Enterprise Security Analyzer Syslog server buffer overflow

Overview The eIQnetworks Enterprise Security Analyzer Syslog server contains a buffer overflow vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Enterprise Security Analyzer eIQnetworks Enterprise Security Analyzer ESA...

Symantec Scan Engine fails to properly perform authentication

Overview Symantec Scan Engine administrative web interface fails to properly authenticate users, which may allow a remote attacker to gain administrative access to the software. Description The Symantec Scan Engine provides a programming interface to Symantec content scanning and virus detection...

US-CERT Technical Cyber Security Alert TA05-180A -- VERITAS Backup Exec Software is actively being exploited

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA05-180A archive VERITAS Backup Exec Software is actively being exploited Original release date: June 29, 2005 Last revised: -- Source: US-CERT Systems Affected VERITAS Backup Exec Remote Age...

DameWare Mini Remote Control vulnerable to buffer overflow via specially crafted packets

Overview DameWare Mini Remote Control is a lightweight remote control intended primarily for administrators and help desks for management of desktop systems. A vulnerability in DameWare Mini Remote Control may permit an unauthenticated attacker to execute arbitrary code on the system. Description...

CERT Advisory CA-2002-32 Backdoor in Alcatel OmniSwitch AOS

-----BEGIN PGP SIGNED MESSAGE----- CERT Advisory CA-2002-32 Backdoor in Alcatel OmniSwitch AOS Original release date: November 21, 2002 Last revised: -- Source: CERT/CC, Alcatel A complete revision history can be found at the end of this file. Systems Affected Alcatel OmniSwitch 7700/7800 switche...

iPlanet Directory Server contains multiple vulnerabilities in LDAP handling code

Overview The iPlanet Directory Server contains vulnerabilities that may allow denial-of-service attacks, unauthorized privileged access, or both. These vulnerabilities were revealed using the PROTOS LDAPv3 test suite and are documented in CERT Advisory CA-2001-18. If your site uses this product,...