Hands-On IoT Hacking: Rapid7 at DefCon 29 IoT Village, Part 4

The first 3 installments of our series on Rapid7's hands-on exercise from the IoT Village at this year's DefCon covered how to set up a UART header, how to determine UART status and baud rate, and how to log into single-user mode on the device. In this final post, we'll discuss how to gain full...

NETGEAR R6400v2 缓冲区错误漏洞

The NETGEAR R6400v2 is a router from Netgear, Inc. A hardware device that connects two or more networks and acts as a gateway between networks, the NETGEAR R6400v2 is vulnerable to a buffer overflow vulnerability that stems from a process failing to properly validate the length of user-supplied...

EulerOS 2.0 SP9 : sssd (EulerOS-SA-2021-2724)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire subcommands. Thi...

EulerOS 2.0 SP5 : sssd (EulerOS-SA-2021-2675)

According to the versions of the sssd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire subcommands. Thi...

CVE-2021-3064

A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the...

CVE-2021-3064

A memory corruption vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to disrupt system processes and potentially execute arbitrary code with root privileges. The attacker must have network access to the...

Palo Alto Networks GlobalProtect 缓冲区错误漏洞

Palo Alto Networks GlobalProtect is a suite of network protection software from Palo Alto Networks, USA. The software provides firewall monitoring and threat prevention. A buffer error vulnerability exists in the Palo Alto Networks GlobalProtect portal and gateway, which can be exploited by an...

Palo Alto Networks PAN-OS 操作系统命令注入漏洞

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances.A command injection vulnerability exists in Palo Alto Networks PAN-OS, which stems from an OS command injection vulnerability in the software's SCEP Simple Certificate The...

openSUSE 15 Security Update : kernel (openSUSE-SU-2021:3641-1)

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2021:3641-1 advisory. The SUSE Linux Enterprise 15 SP3 Azure kernel was updated to receive various security and bugfixes. The following security bugs were fixed: -...

GNU Hurd has an unspecified vulnerability (CNVD-2021-100615)

Gnu Hurd is a Gnu Project replacement for the Unix kernel. Used to implement the file system, network protocols, file access control, and other features implemented by the Unix kernel or similar kernels such as Linux, GNU Hurd has a security vulnerability that could be exploited by an attacker to...

GNU Hurd has unspecified vulnerabilities

Gnu Hurd is a Gnu project replacement for the Unix kernel. It is used to implement the file system, network protocols, file access control, and other features implemented by the Unix kernel or similar kernels such as Linux. GNU Hurd suffers from a security vulnerability that stems from the use of...

GNU Hurd has an unspecified vulnerability (CNVD-2021-100612)

Gnu Hurd is a Gnu project replacement for the Unix kernel. A security vulnerability exists in GNU Hurd, which stems from the fact that in versions of GNU Hurd prior to 0.9 20210404-9 each person who maps a file shares a page navigation port, allowing anyone to modify any file they can read. any...

CVE-2021-43411

An issue was discovered in GNU Hurd before 0.9 20210404-9. When trying to exec a setuid executable, there's a window of time when the process already has the new privileges, but still refers to the old task and is accessible through the old process port. This can be exploited to get full root...

CVE-2021-43413

An issue was discovered in GNU Hurd before 0.9 20210404-9. A single pager port is shared among everyone who mmaps a file, allowing anyone to modify any files that they can read. This can be trivially exploited to get full root access...

CVE-2021-43412

An issue was discovered in GNU Hurd before 0.9 20210404-9. libports accepts fake notification messages from any client on any port, which can lead to port use-after-free. This can be exploited for local privilege escalation to get full root access...

CVE-2021-43413

An issue was discovered in GNU Hurd before 0.9 20210404-9. A single pager port is shared among everyone who mmaps a file, allowing anyone to modify any files that they can read. This can be trivially exploited to get full root access...

Privilege escalation

An issue was discovered in GNU Hurd before 0.9 20210404-9. The use of an authentication protocol in the proc server is vulnerable to man-in-the-middle attacks, which can be exploited for local privilege escalation to get full root access...

Design/Logic Flaw

An issue was discovered in GNU Hurd before 0.9 20210404-9. A single pager port is shared among everyone who mmaps a file, allowing anyone to modify any files that they can read. This can be trivially exploited to get full root access...

CVE-2021-43411

An issue was discovered in GNU Hurd before 0.9 20210404-9. When trying to exec a setuid executable, there's a window of time when the process already has the new privileges, but still refers to the old task and is accessible through the old process port. This can be exploited to get full root...

Design/Logic Flaw

An issue was discovered in GNU Hurd before 0.9 20210404-9. When trying to exec a setuid executable, there's a window of time when the process already has the new privileges, but still refers to the old task and is accessible through the old process port. This can be exploited to get full root...