RHEL 6 : glibc (RHSA-2016:0175)

Updated glibc packages that fix one security issue and two bugs are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Critical security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

OpenSSL加密算法破解漏洞

一、漏洞情况分析 OpenSSL是一个实现安全套接层和安全传输层协议的通用开源加密库，可支持多种加密算法，包括对称密码、哈希算法、安全散列算法等。 OpenSSL存在一处加密算法破解漏洞，但是该漏洞需要同时满足以下条件：OpenSSL版本为 1.0.2-1.0.2e；依赖于openssl的应用程序的签名算法生成的临时密钥必须基于Diffie...

glibc security and bug fix update

2.12-1.166.7 - Update fix for CVE-2015-7547 1296028. 2.12-1.166.6 - Create helper threads with enough stack for POSIX AIO and timers 1301625. 2.12-1.166.5 - Fix CVE-2015-7547: getaddrinfo stack-based buffer overflow 1296028. 2.12-1.166.4 - Support loading more libraries with static TLS 1291270...

glibc security update

2.12-1.166.7 - Update fix for CVE-2015-7547 1296028. 2.12-1.166.6 - Create helper threads with enough stack for POSIX AIO and timers 1301625. 2.12-1.166.5 - Fix CVE-2015-7547: getaddrinfo stack-based buffer overflow 1296028. 2.12-1.166.4 - Support loading more libraries with static TLS 1291270...

eucan09.static-univadis.com XSS vulnerability

Vulnerable URL: http://eucan09.static-univadis.com/external/exit/?r=javascript:alert/XSSPOSED/iframe=1strategy=0window=1 Details: Description| Value ---|--- Patched:| Yes, at 29.02.2016 Latest check for patch:| 29.02.2016 19:00 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

la05.static-univadis.com XSS vulnerability

Vulnerable URL: http://la05.static-univadis.com/external/exit/?r=javascript:alert/XSSPOSED/iframe=1strategy=0window=1 Details: Description| Value ---|--- Patched:| Yes, at 29.02.2016 Latest check for patch:| 29.02.2016 18:54 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

eucan04.static-univadis.com XSS vulnerability

Vulnerable URL: http://eucan04.static-univadis.com/external/exit/?r=javascript:alert/XSSPOSED/iframe=1strategy=0window=0 Details: Description| Value ---|--- Patched:| Yes, at 29.02.2016 Latest check for patch:| 29.02.2016 18:55 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

eucan05.static-univadis.com XSS vulnerability

Vulnerable URL: http://eucan05.static-univadis.com/external/exit/?r=javascript:alert/XSSPOSED/iframe=1strategy=0window=1 Details: Description| Value ---|--- Patched:| Yes, at 29.02.2016 Latest check for patch:| 29.02.2016 18:57 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

eucan02.static-univadis.com XSS vulnerability

Vulnerable URL: http://eucan02.static-univadis.com/external/exit/?r=javascript:alert/XSSPOSED/iframe=1strategy=0window=1 Details: Description| Value ---|--- Patched:| Yes, at 29.02.2016 Latest check for patch:| 29.02.2016 18:54 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

la02.static-univadis.com XSS vulnerability

Vulnerable URL: http://la02.static-univadis.com/external/exit/?r=javascript:alert/XSSPOSED/iframe=1strategy=0window=1 Details: Description| Value ---|--- Patched:| Yes, at 29.02.2016 Latest check for patch:| 29.02.2016 18:53 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed...

eucan10.static-univadis.com XSS vulnerability

Vulnerable URL: http://eucan10.static-univadis.com/external/exit/?r=javascript:alert/XSSPOSED/iframe=1strategy=0window=1 Details: Description| Value ---|--- Patched:| Yes, at 29.02.2016 Latest check for patch:| 29.02.2016 18:55 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclose...

Huawei E5186 4G LTE Router Security Bypass Vulnerability

Huawei E5186 4G LTE Router is a 4G wireless router product from Huawei, China. The Huawei E5186 4G LTE Router allows DNS query packets to use static source ports, allowing remote attackers to exploit this vulnerability to forge responses...

OpenSSL Key Recovery Attack on DH small subgroups (CVE-2016-0701)

Usual Mandatory Disclaimer: IANAC I am not a cryptographer so I might likely end up writing a bunch of mistakes in this blog post... tl;dr The OpenSSL 1.0.2 releases suffer from a Key Recovery Attack on DH small subgroups. This issue got assigned CVE-2016-0701 with a severity of High and OpenSSL...

Security Advisory - DNS Static Source Port Vulnerability in Huawei E5151 and E5186

Huawei E5151 and E5186 allow DNS query packets using the static source port. Attackers can exploit the vulnerability to launch DNS Spoofing Attack and compromise the normal service of DNS. Vulnerability ID: HWPSIRT-2015-10001 This vulnerability has been assigned Common Vulnerabilities and Exposur...

Vulnerability in OpenSSL - DH small subgroups

Historically OpenSSL usually only ever generated DH parameters based on “safe” primes. More recently in version 1.0.2 support was provided for generating X9.42 style parameter files such as those required for RFC 5114 support. The primes used in such files may not be “safe”. Where an application ...

How to Change Order of NICs in XenServer

Theinterface-rename is a utility included in Citrix Hypervisor 8.2 Cumulative Update 1 and XenServer 8. This utility allows for granular management of network interface cards to facilitate renaming and reordering of them from the default installed configuration. The interface-rename utility refer...

Wireshark - hiqnet_display_data Static Out-of-Bounds Read

Source: https://code.google.com/p/google-security-research/issues/detail?id=695 The following crash due to a static out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$ ./tshark -nVxr /path/to/file": --- cut ---...

Wireshark - hiqnet_display_data Static Out-of-Bounds Read

Wireshark - hiqnetdisplaydata Static Out-of-Bounds Read Source: https://code.google.com/p/google-security-research/issues/detail?id=695 The following crash due to a static out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Wireshark - hiqnet_display_data Static Out-of-Bounds Read

Exploit for multiple platform in category dos / poc Source: https://code.google.com/p/google-security-research/issues/detail?id=695 The following crash due to a static out-of-bounds read can be observed in an ASAN build of Wireshark current git master, by feeding a malformed file to tshark "$...

Cross Platform ELF Analysis: ELF Parser

ELF Parser attempts to move ELF malware analysis forward by quickly providing basic information and static analysis of the binary. The end goal of ELF Parser is to indicate to the analyst if it thinks the binary is malicious / dangerous and if so why. Load Any Executable ELF ELF Parser supports...