Exploit for Out-of-bounds Write in Polkit_Project Polkit

CVE-2021-4034 CVE-2021-40...

EDR Is Dead. Long Live Multi-Vector EDR.

News of EDR’s demise has been greatly exaggerated. Fact is: older approaches to EDR have to move over. There’s a new solution now: Multi-Vector EDR. This blog reviews the highlights of our latest release of this critically important app on the Qualys Cloud Platform. Although it now seems like a...

Qualys Multi-Vector EDR Excels in 2022 MITRE ATT&CK Evaluation

MITRE evaluated Qualys Multi-Vector EDR against competing alternatives, and the results are in. This blog reviews the basics of MITRE ATT&CK evaluation, how our EDR solution performed, and how to interpret the ratings. MITRE Engenuity has released the results of round 4 of its ATT&CK Evaluations...

Infographic: Log4Shell Vulnerability Impact by the Numbers

The full scope of risk presented by the Log4Shell vulnerability is something unprecedented, spanning every type of organization across every industry. Hard to find but easy to exploit, Log4Shell immediately places hundreds of millions of Java-based applications, databases, and devices at risk...

Qualys Study Reveals How Enterprises Responded to Log4Shell

On December 9, 2021, a critical zero-day vulnerability affecting Apache’s Log4j2 library, a Java-based logging utility, was disclosed to the world. This was no small announcement. As the third most used computer language, Java is practically ubiquitous. Its Log4j2 library is extremely popular...

Casdoor SQL Injection (CVE-2022-24124)

On Jan 22, 2022, a high severity SQL Injection vulnerability was reported in Casdoor which affected versions before 1.13.1 release. The vulnerability is tracked as CVE-2022-24124 with CVSS V3 7.5 score has a publicly available simple proof of concept which makes it easier for skilled attackers to...

PwnKit-Exploit - Proof Of Concept (PoC) CVE-2021-4034

Proof Of Concept PoC CVE-2021-4034 @c0br40x help to make this section in README!! Proof of Concept debian@debian:/PwnKit-Exploit$ make cc -Wall exploit.c -o exploit debian@debian:/PwnKit-Exploit$ whoami debian debian@debian:/PwnKit-Exploit$ ./exploit Current User before execute exploit...

Polkit pkexec Local Privilege Escalation Exploit

This is a Metasploit module for the argument processing bug in the polkit pkexec binary. If the binary is provided with no arguments, it will continue to process environment variables as argument variables, but without any security checking. By using the execve call we can specify a null argument...

Polkit pkexec Local Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Local Privilege Escalation in polkits pkexec', 'Description' = %q A bug exists in the polkit pkexec binary in how it processes arguments. If the...

Russia-Ukraine Crisis: How to Strengthen Your Security Posture to Protect against Cyber Attack, based on CISA Guidelines

CISA has created Shields Up as a response to the Russian invasion of Ukraine. Qualys is responding with additional security, monitoring and governance measures. This blog details how and what our enterprise customers can do to immediately strengthen their security posture and meet CISA’s...

Meet FedRAMP Compliance with Qualys Cloud Platform

FedRAMP compliance is not without its challenges. Learn about some of the major security controls and how the Qualys Cloud Platform can help achieve FedRAMP authorization. What is FedRAMP? The Federal Risk and Authorization Management Program FedRAMP is a U.S. government program that promotes the...

Enhanced Native DNS based Scanning with Qualys VMDR

Network based scanning of modern infrastructure is getting very complex, especially when the assets are behind CDNs, load balancers, firewalls, and more recently, ephemeral assets that spin up/down as required. This blog describes recent enhancements to Qualys Cloud Platform that allow native...

PwnKit vulnerability affects multiple SICK IPCs

CVE-2021-4034 is a Local Privilege Escalation LPE vulnerability, located in the "Polkit" package installed by default on almost every major distribution of the Linux operating system. On 2022-01-25, Qualys released an advisory for this LPE vulnerability, advising to either update the “Polkit”...

Managing CISA Known Exploited Vulnerabilities with Qualys VMDR

CISA released a directive in November 2021, recommending urgent and prioritized remediation of actively exploited vulnerabilities. Both government agencies and corporations should heed this advice. This blog outlines how Qualys Vulnerability Management, Detection & Response can be used by any...

New Linux Privilege Escalation Flaw Uncovered in Snap Package Manager

Multiple security vulnerabilities have been disclosed in Canonical's Snap software packaging and deployment system, the most critical of which can be exploited to escalate privilege to gain root privileges. Snaps are self-contained application packages that are designed to work on operating syste...

USN-5292-3: snapd vulnerabilities

USN-5292-1 fixed several vulnerabilities in snapd. This update provides the corresponding update for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. Original advisory details: James Troup discovered that snap did not properly manage the permissions for the snap directories. A local attacker could possibly...

Oh Snap! More Lemmings: Local Privilege Escalation Vulnerability Discovered in snap-confine (CVE-2021-44731)

The Qualys Research Team has discovered multiple vulnerabilities in the snap-confine function on Linux operating systems, the most important of which can be exploited to escalate privilege to gain root privileges. Qualys recommends security teams apply patches for these vulnerabilities as soon as...

Introducing Qualys Context XDR: the Difference between Chaos & Clarity

In my role as a product leader, I have the pleasure of meeting security practitioners from organizations big and small, across multiple industry segments and geographies. No matter how large or small their budget or staff is, how much they’ve invested in their tech stack or how much experience th...

Catching the RAT called Agent Tesla

For the last few years, the Qualys Research Team has been observing an infamous "Malware-as-a-service" RAT Remote Access Trojan called Agent Tesla. It first appeared in 2014, and since then many variants have been deployed. This malware uses multiple techniques for evading detection as well as...

Vulnerability Remediation: It’s Not Just Patching

Vulnerability does not equal a patch, as such remediating a detected vulnerability requires deploying the right patches and, in some cases, making the right configuration changes. Using multiple tools to detect, map and deploy the right remediation actions is time consuming and will result in les...