CVE-2019-3869

When running Tower on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges...

Arbitrary Code Execution

ansible is vulnerable to arbitrary code execution. The application loads certain host/group variables from the current working directory when ad-hoc command line commands are run and a playbook or playbook base directory is not specified. This can allow a malicious user to inject and execute...

Partner Perspectives: Notes from the Field: Extending Carbon Black Visibility to Undetected Malware

Daniel LaVoie is a Senior Solutions Specialist at ReversingLabs. On a recent customer visit, I asked the company’s Director of Security Operations how ReversingLabs came to be deployed as a part of their SOC tool set. The answer was quite interesting, and one that I wanted to share with our blog...

The Incident Response Tracking Application: DFIRTrack

DFIRTrack Digital Forensics and Incident Response Tracking application is an open source web application mainly based on Django using a PostgreSQL database backend. In contrast to other great incident response tools, which are mainly case-based and support the work of CERTs, SOCs etc. in their...

Partner Perspectives: More Effective Threat Hunting with ThreatConnect and Carbon Black

Megan Horner is the Director of Product Marketing for ThreatConnect. You’ll hear a lot in cybersecurity - and in technology in general - about the necessity of integrations. The more security solutions can communicate back and forth with what they find “in the wild” and how it compares to what’s...

CVE-2017-12148

A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that...

Aker - SSH Bastion/Jump Host/Jumpserver

Aker is a security tool that helps you configure your own Linux ssh jump/bastion host. Named after an Egyptian mythology deity who guarded the borders, Aker would act as choke point through which all your sysadmins and support staff access Linux production servers. Aker SSH gateway includes a lot...

Cloud Migration Fundamentals: Overcoming Barriers to App Security [Infographic]

As more organizations move to the cloud, the line of responsibility in securing applications can become rather blurred. The concept of control has historically rested in physical location and ownership. With the move to the cloud, however, the idea of security by proxy is changing and so should o...

The Gartner CISO Playbook: Leveraging Effective Control in the Cloud

For as long as we can remember, the concept of control has rested comfortably in physical location and ownership. It’s simple, if you could see something or you knew exactly where it was, it would be easier to assume that you’d have some measure of control over its security. With the move to the...

Join Microsoft for a security in a day workshop

Let's talk about an integrated security experience. Many of our customers are in various stages of cybersecurity maturity: Initializing Firefighting No formal security program Developing Point solutions/tools for basic controls Pockets of expertise Defining Aligned to frameworks Documented contro...

Distributed Network Vulnerability Scanner: Prowler

Prowler is a Network Vulnerability Scanner implemented on a Raspberry Pi Cluster, first developed during Singapore Infosec Community Hackathon – HackSmith v1.0. Capabilities Scan a network a particular subnet or a list of IP addresses for all IP addresses associated with active network devices...

Tower: modification of git hooks in SCM repo via upstream playbook execution

A flaw was found in Tower's interface with SCM repositories. If a Tower project SCM repository definition does not have the 'delete before update' flag set, an attacker with commit access to the upstream playbook source repository could create a Trojan playbook that, when executed by Tower,...

Partner Perspectives: How to Quickly Automate a Response Playbook With Carbon Black

Editor's Note: This blog originally appeared on Red Canary's website. Outwardly, Red Canary appears to focus heavily on the “Detection” in Endpoint Detection and Response. Much of what we share addresses the need to understand the platforms that we defend, and techniques that can be applied to...

Partner Perspective: Integrated Endpoint Protection and Response

Editor's Note: The post originally appeared on LogRhythm.com Maintaining visibility of hundreds—if not thousands—of endpoints and then taking corrective actions to the discovered abnormalities is a critical security challenge many organizations face today. Most organizations dedicate substantial...

Ansible Agent Payload Deployer

This exploit module creates an ansible module for deployment to nodes in the network. It creates a new yaml playbook which copies our payload, chmods it, then runs it on all targets which have been selected default all. Module Options msf use exploit/linux/local/ansible/nodedeployer msf...

Advanced Threat Analytics プレイブックを使って攻撃をシミュレーションし検出する方法

本記事は、Microsoft Advanced Threat Analytics Team のブログ “How to simulate and detect attacks with the Advanced Threat Analytics Playbook” 2017 年 2 月 23...

Exploit for Race Condition in Canonical Ubuntu_Linux

Description Playbook for testing the dirty cow...

Updated ansible package fixes multiple security issues

Updated ansible package fixes security vulnerabilities: The Ansible platform before version 1.6.7 suffers from input sanitization errors that allow arbitrary code execution as well as information leak, in case an attacker is able to control certain playbook variables CVE-2014-4678, CVE-2014-4966,...

BlackBerry Releases Security Advisory

BlackBerry has released a security advisory that addresses Adobe® Flash® remote code execution vulnerabilities that affect BlackBerry® Z10, BlackBerry® Q10 smartphone and BlackBerry® PlayBook™ tablet customers. These vulnerabilities could potentially allow an attacker to execute code with the...

CVE-2013-4260

lib/ansible/playbook/init.py in Ansible 1.2.x before 1.2.3, when playbook does not run due to an error, allows local users to overwrite arbitrary files via a symlink attack on a retry file with a predictable name in /var/tmp/ansible/...