suidperl Privilege Escalation (PROCSUID)

The suidperl application is installed on the remote host. It is, therefore, affected by a privilege escalation vulnerability that allows a local attacker to gain root privileges. PROCSUID is one of multiple Equation Group vulnerabilities and exploits disclosed on 2017/04/08 by a group known as th...

Netscape Enterprise Server Basic Authentication Buffer Overflow RCE (EGGBASKET/XP_NS-HTTPD)

According to its banner, the Netscape Enterprise Server running on the remote host is either version 3.6 or 3.6 SP1. It is, therefore, affected by a buffer overflow condition in the HTTP Basic Authentication module of the server. An unauthenticated, remote attacker can exploit this to execute...

Shadow Brokers Launches 0-Day Exploit Subscriptions for $21,000 Per Month

As promised to release more zero-days exploits and hacking tools for various platforms starting from June 2017, the infamous hacking group Shadow Brokers is back with more information on how to subscribe and become a private member for receiving exclusive access to the future leaks. The Shadow...

SMB Exploited: WannaCry Use of "EternalBlue"

Server Message Block SMB is the transport protocol used by Windows machines for a wide variety of purposes such as file sharing, printer sharing, and access to remote Windows services. SMB operates over TCP ports 139 and 445. In April 2017, Shadow Brokers released an SMB vulnerability named...

Wanna Cry Again? NSA’s Windows 'EsteemAudit' RDP Exploit Remains Unpatched

Brace yourselves for a possible 'second wave' of massive global cyber attack, as SMB Server Message Block was not the only network protocol whose zero-day exploits created by NSA were exposed in the Shadow Brokers dump last month. Although Microsoft released patches for SMB flaws for supported...

Vulnerability Management Tips for the Shadow Brokers Leaked Exploits

Rebekah Brown and the Rapid7 team have delivered a spot-on breakdown of the recent Shadow Brokers exploit and tool release. Before you read any further, if you havent done so already, please read her post. Its probably not the only post youve read on this topic, but it is cogent, well-constructed...

The Latest on WannaCry, UIWIX, EternalRocks and ShadowBrokers

Ransomware has gained global attention over the course of the last two weeks due to the huge spread of WannaCry. Following the initial attacks, we’ve seen UIWIX, Adylkuzz and now EternalRocks come onto the scene leveraging the same core set of vulnerabilities. The common thread between the three...

Cobalt RaQ4 Administrative Interface backup.cgi Command Execution (EXTINCTSPINACH)

The Cobalt RaQ4 administrative interface running on the remote host is affected by a remote command execution vulnerability in the /cgi-bin/.cobalt/backup/backup.cgi script. An unauthenticated, remote attacker can exploit this to execute arbitrary commands. EXTINCTSPINACH is one of multiple...

EternalBlue: Metasploit Module for MS17-010

This week's release of Metasploit includes a scanner and exploit module for the EternalBlue vulnerability, which made headlines a couple of weeks ago when hacking group, the Shadow Brokers, disclosed a trove of alleged NSA exploits. Included among them, EternalBlue, exploits MS17-010, a Windows S...

More Hacking Groups Found Exploiting SMB Flaw Weeks Before WannaCry

Since the Shadow Brokers released the zero-day software vulnerabilities and hacking tools – allegedly belonged to the NSA's elite hacking team Equation Group – several hacking groups and individual hackers have started using them in their own way. The April's data dump was believed to be the most...

Visualizing WannaCry & Shadow Brokers with Dashboards

To assess infections from WannaCry ransomware and threat exposure from the Shadow Brokers vulnerabilities across an entire IT environment, it's helpful to visualize your exposure via dynamic dashboards. Using Qualys AssetView and ThreatPROTECT, I created a single-pane incident response dashboard...

SMBv1 Server Detection

Binary data 700100.prm...

[SECURITY] [DSA 3793-2] shadow regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3793-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 17, 2017 https://www.debian.org/security/faq -...

[SECURITY] [DSA 3793-2] shadow regression update

------------------------------------------------------------------------- Debian Security Advisory DSA-3793-2 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso May 17, 2017 https://www.debian.org/security/faq -...

For GDPR Readiness, You Need Visibility into Your IT Assets

The looming deadline for complying with the EU’s General Data Protection Regulation GDPR is shining the spotlight on a foundational InfoSec best practice: A comprehensive IT asset inventory. The reason: GDPR places strict requirements on the way a business handles the personally identifiable...

USN-3276-2 shadow regression

USN-3276-1 intended to fix a vulnerability in su. The solution introduced a regression in su signal handling. This update modifies the security fix. We apologize for the inconvenience. Original advisory details: Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker...

USN-3276-2: shadow regression

USN-3276-1 intended to fix a vulnerability in su. The solution introduced a regression in su signal handling. This update modifies the security fix. We apologize for the inconvenience. Original advisory details: Sebastian Krahmer discovered integer overflows in shadow utilities. A local attacker...

DSA-3793-2 shadow - regression update

Bulletin has no description...

Ubuntu 14.04 LTS / 16.04 LTS : shadow regression (USN-3276-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3276-2 advisory. USN-3276-1 intended to fix a vulnerability in su. The solution introduced a regression in su signal handling. This update modifies the security fix. W...

The next“eternal blue”6 months? Shadow Brokers organization announced that it will open more 0day vulnerabilities it! - Vulnerability warning-the black bar safety net

! 5 month 12 days late, a WannaCry worms ransomware attacks in the global network, which is considered by far the most huge extortion payment activities, the impact to nearly a hundred countries and thousands of businesses and public organizations. This virus is the use of“N. S. A. arms Gallery”i...