polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork

polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork / When a non-root user attempts to e.g. control systemd units in the system instance from an active session over DBus, the access is gated by a polkit policy that requires "authadminkeep" auth. This results in an auth prompt bein...

polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork

/ When a non-root user attempts to e.g. control systemd units in the system instance from an active session over DBus, the access is gated by a polkit policy that requires "authadminkeep" auth. This results in an auth prompt being shown to the user, asking the user to confirm the action by enteri...

polkit - Temporary auth Hijacking via PID Reuse and Non-atomic Fork Exploit

/ When a non-root user attempts to e.g. control systemd units in the system instance from an active session over DBus, the access is gated by a polkit policy that requires "authadminkeep" auth. This results in an auth prompt being shown to the user, asking the user to confirm the action by enteri...

KingSCADA 3.7 Exploit Re-exploit Vulnerability

KingSCADA is a high-end configuration software developed by Beijing Asian Control Technology Development Co. A release reuse vulnerability exists in KingSCADA 3.7. An attacker can exploit this vulnerability to cause a denial of service attack...

SUSE SLES12 Security Update : compat-openssl098 (SUSE-SU-2015:0553-1)

OpenSSL was updated to fix various security issues. Following security issues were fixed : - CVE-2015-0209: A Use After Free following d2iECPrivatekey error was fixed which could lead to crashes for attacker supplied Elliptic Curve keys. This could be exploited over SSL connections with client...

CVE-2018-6337

folly::secureRandom will re-use a buffer between parent and child processes when fork is called. That will result in multiple forked children producing repeat or similar results. This affects HHVM 3.26 prior to 3.26.3 and the folly library between v2017.12.11.00 and v2018.08.09.00...

CVE-2018-6337

The CVE-2018-6337 issue affects HHVM and the folly library, caused by folly::secureRandom re-using a buffer between parent and child processes after fork(). This can lead to repeated or correlated random outcomes across multiple forked children. Affected products/versions: HHVM prior to 3.26.3; f...

UBUNTU-CVE-2018-18509

A flaw during verification of certain S/MIME signatures causes emails to be shown in Thunderbird as having a valid digital signature, even if the shown message contents aren't covered by the signature. The flaw allows an attacker to reuse a valid S/MIME signature to craft an email message with...

Netwide Assembler (NASM) Post-Release Reuse Vulnerability

Netwide Assembler NASM is a portable, modular 80x86 and x86-64 assembler. A post-release reuse vulnerability in the ppgetline function in asm/preproc.c in Netwide Assembler NASM 2.14rc16 can be exploited by an attacker to cause a denial of service...

CVE-2018-20168

Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service "physical address not valid" panic via a crafted application...

CVE-2018-20168

Google gVisor before 2018-08-22 reuses a pagetable in a different level with the paging-structure cache intact, which allows attackers to cause a denial of service "physical address not valid" panic via a crafted application...

Remote Code Execution (RCE)

microsoft.chakracore is vulnerable to remote code execution. This is due to a buffer overflow in TypeHandler caused by an invalid index reuse, which would allow an attacker to execute arbitrary code in the context of the authenticated user. This CVE ID is different from CVE-2017-8517 and...

Breaches, breaches everywhere, it must be the season

After last weeks shocker from Marriott this week started off with disclosures about breaches at Quora, Dunkin’ Donuts, and 1-800-Flowers. Quora Quora is an online community that focuses on asking and answering questions. It was founded in 2009 by two former Facebook employees. The stolen data may...

WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion

WebKit JSC JIT - JSPropertyNameEnumerator Type Confusion / When a for-in loop is executed, a JSPropertyNameEnumerator object is created at the beginning and used to store the information of the input object to the for-in loop. Inside the loop, the structure ID of the "this" object of every getbyi...

QEMU Denial of Service Vulnerability (CNVD-2018-26706)

QEMU aka Quick Emulator is a set of simulation processor software developed by French programmer Fabrice Bellard. The software is fast and cross-platform. A security vulnerability exists in the hw/9pfs/cofile.c and hw/9pfs/9p.c files in QEMU. An attacker can exploit this vulnerability to cause a...

DEBIAN-CVE-2018-16862

A security flaw was found in the Linux kernel in a way that the cleancache subsystem clears an inode after the final file truncation removal. The new file created with the same inode may contain leftover pages from cleancache and the old file data instead of the new one...

curl: Case insensitive password comparison

A flaw was found in curl before version 7.51.0 When re-using a connection, curl was doing case insensitive comparisons of user name and password with the existing connections. This means that if an unused connection with proper credentials exists for a protocol that has connection-scoped...

Podcast: Troy Hunt Talks Bad Passwords – and Who’s to Blame for Them

With credential-stuffing making headlines when it comes to certain data breaches – including the recent HSBC breach reported earlier this week – the security community has continued to ponder an age-old question: Who is responsible for effective password hygiene and security measures? The account...

ThreatList: Despite Fraud Awareness, Password Reuse Persists for Half of U.S. Consumers

As National Fraud Day approaches Nov. 11, it remains clear that more consumer education is required when it comes to thwarting scammers and identity thieves. Despite almost half of U.S. consumers 49 percent believing their security habits make them vulnerable to information fraud or identity thef...

ZTE ZXR10 8905E TCP Initial Serial Number (ISN) Reuse Vulnerability

The ZTE ZXR10 8905E is a router product from China's ZTE ZTE. A security vulnerability exists in the ZTE ZXR10 8905E 3.03.10.B23P2 and previous versions. A remote attacker can exploit this vulnerability to conduct spoofing attacks...