freerdp: Integer overflow leading to heap-based buffer overflow in gdi_Bitmap_Decompress() function

A flaw was found in freerdp in versions before versions 2.0.0-rc4. An integer overflow that leads to a heap-based buffer overflow in the gdiBitmapDecompress function leads to memory corruption. The highest threat from this vulnerability is to data confidentiality and integrity as well as system...

TAU Threat Intelligence Notification: Operation SharpShooter

Operation Sharpshooter, leverages an embedded shellcode as an in-memory implant to download and retrieve a second-stage implant, which is known as Rising Sun. Rising Sun uses source code from the Duuzer backdoor that has been used in a past campaign of Lazarus group. This newly discovered campaig...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Personal Communications (CVE-2015-2808)

Summary The RC4 “Bar Mitzvah” Attack for SSL/TLS affects IBM Personal Communications. Vulnerability Details CVEID: CVE-2015-2808 DESCRIPTION: The RC4 algorithm, as used in the TLS protocol and SSL protocol, could allow a remote attacker to obtain sensitive information. An attacker could exploit...

SUSE SLED15 / SLES15 Security Update : freerdp (SUSE-SU-2019:0539-1)

This update for freerdp to version 2.0.0rc4 fixes the following issues : Security issues fixed : CVE-2018-0886: Fix a remote code execution vulnerability CredSSP bsc1085416, bsc1087240, bsc1104918 CVE-2018-8789: Fix several denial of service vulnerabilities in the in the NTLM Authentication modul...

Chafer APT Takes Aim at Diplomats in Iran with Improved Custom Malware

UPDATE An Iran-linked APT known as Chafer has been spotted targeting various entities based in Iran with an enhanced version of a custom malware that takes a very unique approach to communication by using the Microsoft Background Intelligent Transfer Service BITS mechanism over HTTP. Meanwhile th...

Security Bulletin: Vulnerability in RC4 stream cipher affects MegaRAID Storage Manager (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the vulnerability. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects MegaRAID Storage Manager. MegaRAID Storage Manager has addressed the...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Flex System Chassis Management Module (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Flex System Chassis Management Module. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Flex System Chassis Management Module. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4 algorithm...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Systems Director Editions (CVE-2015-2808)

Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects Tivoli Application Dependency Discovery Manager, IBM Tivoli Monitoring, and IBM Systems Director which are shipped as components of IBM System Director Editions. Information about the security vulnerabilityaffecting these components has been...

Security Bulletin: Vulnerability in RC4 cipher stream and multiple vulnerabilities in IBM SDK Java Technology Edition affects IBM Systems Director

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition 7 that is used by IBM Systems Director. These issues were disclosed as part of the IBM Java SDK updates in January and April 2015. This bulletin also addresses the RC4 bar mitzvah attack on SSL/TLS. Vulnerability Detail...

Security Bulletin: Vulnerability in RC4 cipher stream (CVE-2015-2808) and multiple vulnerabilities in IBM SDK Java Technology Edition affects IBM Systems Director

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition 7 that is used by IBM Systems Director. These issues were disclosed as part of the IBM Java SDK updates in January and April 2015. This bulletin also addresses the RC4 bar mitzvah attack on SSL/TLS. Vulnerability Detail...

Security Bulletin: Vulnerability in RC4 cipher stream (CVE-2015-2808) and multiple vulnerabilities in IBM SDK Java Technology Edition affects IBM Systems Director.

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition 7 that is used by IBM Systems Director. These issues were disclosed as part of the IBM Java SDK updates in January and April 2015. This bulletin also addresses the RC4 bar mitzvah attack on SSL/TLS. Vulnerability Detail...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Flex System Manager (FSM) (CVE-2015-2808)

Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects IBM Flex System Manager FSM. Vulnerability Details Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects IBM Flex System Manager FSM. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol an...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Systems Director Storage Control (CVE-2015-2808)

Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects IBM Systems Director Storage Control. Vulnerability Details Summary The RC4 Bar Mitzvah Attack for SSL/TLS affects IBM Systems Director Storage Control. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in t...

Security Bulletin: Vulnerability in RC4 stream cipher affects Integrated Management Module 2 (IMM2) (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Integrated Management Module 2 IMM2. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Integrated Management Module 2 IMM2. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Fabric Manager (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Fabric Manager. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Fabric Manager. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol...

Security Bulletin: Vulnerability in RC4 stream cipher affects Flex System Chassis Management Module (CMM) (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Flex System Chassis Management Module CMM. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects Flex System Chassis Management Module CMM. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4 algorithm...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM System Networking RackSwitch (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM System Networking RackSwitch. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM System Networking RackSwitch. Vulnerability Details CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TL...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware. (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM Flex System FC3171 8Gb SAN Switch and SAN Pass-thru firmware. Vulnerability Details CVE-ID:...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM ToolsCenter (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM ToolsCenter. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM ToolsCenter. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4 algorithm, as used in the TLS protocol and SSL protocol, coul...

Security Bulletin: Vulnerability in RC4 stream cipher affects IBM BladeCenter Advanced Management Module (CVE-2015-2808)

Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM BladeCenter Advanced Management Module. Vulnerability Details Summary The RC4 "Bar Mitzvah" Attack for SSL/TLS affects IBM BladeCenter Advanced Management Module. Vulnerability Details: CVE-ID: CVE-2015-2808 Description: The RC4...