Samsung SBeam Remote Code Execution Vulnerability

Samsung SBeam is a set of tools from Samsung South Korea for transferring large-volume files in close proximity to smartphones. A remote code execution vulnerability exists in Samsung SBeam that stems from the program's failure to properly handle SBeam peer-to-peer wireless connections. When the...

CVE-2015-4144

CVE-2015-4144 affects hostapd and wpa_supplicant EAP-pwd server/peer implementations (versions 1.0–2.4). The issue is missing validation that a message is long enough to contain the Total-Length field, enabling a remote attacker to trigger a denial of service (crash) via crafted messages. The lin...

CVE-2015-4143

CVE-2015-4143 affects the EAP-pwd server/peer in hostapd and wpa_supplicant (versions 1.0–2.4), enabling remote denial of service via crafted payloads (Commit/Confirm). Root cause: missing payload length validation in EAP-pwd messages, causing out-of-bounds read and crash. Remediation: apply upda...

wpa_supplicant: P2P SSID processing vulnerability

A buffer overflow flaw was found in the way wpasupplicant handled SSID information in the Wi-Fi Direct / P2P management frames. A specially crafted frame could allow an attacker within Wi-Fi radio range to cause wpasupplicant to crash or, possibly, execute arbitrary code...

Researchers: Patch Incomplete for Hola VPN Vulnerabilities

Hola, a popular, free, peer-to-peer service that enables anonymous surfing and access to blocked online resources, said today it has patched vulnerabilities discovered last week that expose its millions of users to possible code execution, remote monitoring and other threats to privacy and...

CVE-2015-4146

The EAP-pwd peer implementation in hostapd and wpasupplicant 1.0 through 2.4 does not clear the L Length and M More flags before determining if a response should be fragmented, which allows remote attackers to cause a denial of service crash via a crafted message...

How to Share Sensitive Files Instantly and Securely

Last week, I have to communicate with my friend overseas in China. We both were aware that our email communications were being monitored. So, we both were forced to install and use a fully-fledged encrypted email system. Although it appeared to be very secure, it was quite cumbersome to handle. I...

Fedora 22 : wpa_supplicant-2.3-3.fc22 (2015-6898)

This update addresses a security vulnerability identified as CVE-2015-1863 . More information on this vulnerability is provided by upstream at https://w1.fi/security/2015-1/wpasupplicant-p2p-ssid-overflow.txt . An extract : Attacker or a system controlled by the attacker needs to be within radio...

DEBIAN-CVE-2015-1863

Heap-based buffer overflow in wpasupplicant 1.0 through 2.4 allows remote attackers to cause a denial of service crash, read memory, or possibly execute arbitrary code via crafted SSID information in a management frame when creating or updating P2P entries...

wpa_supplicant P2P SSID Handling Vulnerability

wpasupplicant is a set of daemons that run in the background to support WEP, WPA/WPA2 and WAPI wireless protocols and encrypted authentication. A buffer overflow vulnerability exists in the wpasupplicant 'p2padddevice' function src/p2p/p2p.c, which allows an attacker to submit a specially crafted...

USN-2577-1: wpa_supplicant vulnerability

It was discovered that wpasupplicant incorrectly handled SSID information when creating or updating P2P peer entries. A remote attacker could use this issue to cause wpasupplicant to crash, resulting in a denial of service, expose memory contents, or possibly execute arbitrary code...

USN-2577-1 wpa vulnerability

It was discovered that wpasupplicant incorrectly handled SSID information when creating or updating P2P peer entries. A remote attacker could use this issue to cause wpasupplicant to crash, resulting in a denial of service, expose memory contents, or possibly execute arbitrary code...

Updated ntp packages fix security vulnerabilities

Updated ntp packages fix security vulnerabilities: The symmetric-key feature in the receive function in ntpproto.c in ntpd in NTP before 4.2.8p2 requires a correct MAC only if the MAC field has a nonzero length, which makes it easier for man-in-the-middle attackers to spoof packets by omitting th...

Debian DSA-3223-1 : ntp - security update

Multiple vulnerabilities were discovered in ntp, an implementation of the Network Time Protocol : - CVE-2015-1798 When configured to use a symmetric key with an NTP peer, ntpd would accept packets without MAC as if they had a valid MAC. This could allow a remote attacker to bypass the packet...

BitTorrent Sync （peer-to-peer file synchronization system on there is a high risk of command injection vulnerability-vulnerability warning-the black bar safety net

According to HP 0day plans ZDI in last week's announcement that BitTorrent Sync on the presence of a high-risk vulnerability, an attacker can remotely execute arbitrary code. The black bar safety net science BitTorrent Sync is BitTorrent network technology company launched in multiple computers f...

openSUSE Security Update : mercurial (openSUSE-2015-268)

mercurial was updated to fix a command Injection via sshpeer.validaterepo CVE-2014-9462, bnc923070. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2015-268. The text description of...

Malware Communication Analyzer: Malcom

Malcom is a tool designed to analyze a system’s network communication using graphical representations of network traffic, and cross-reference them with known malware sources. This comes handy when analyzing how certain malware species try to communicate with the outside world. Malcom can help you...

OTR.to — Secure 'Off-the-Record' p2p Encrypted Messaging Service

In this post-Snowden era of mass surveillance, being out-of-reach from the spying eyes really doesn't mean they can not get you. So, if you are concerned about your data privacy and are actually searching for a peer-to-peer encrypted messaging service, then it’s time to get one. "Otr.to" — an...

ZeroAccess Returns, Resumes Click-Fraud Activity

Long thought dead, the peer-to-peer P2P ZeroAccess botnet has resurfaced, and as of just a few weeks ago, has returned to propagating click-fraud scams. Researchers with Dell’s SecureWorks revealed Wednesday that they witnessed the botnet restart itself from March 21 to July 2, 2014 and that...

Tribler - Download Torrents using Tor-inspired onion routing

Tribler is a research project of Delft University of Technology. Tribler was created over nine years ago as a new open source Peer-to-Peer file sharing program. During this time over one million users have installed it successfully and three generations of Ph.D. students tested their algorithms i...