A week in security (May 7 – May 13)

Last week on Labs, we looked at the case of a fake Android AV, an annoying adware that goes by the name of Kuik, the return of threat actors behind the Shopper Stop tech scam, a new Netflix phishing scam, the recent zero-day vulnerability in Internet Explorer, and the insufficiency of merely...

Tech support scam uses fake Shoppers Stop site to lure thousands

Update 2018-05-17: Shoppers Stop is a legitimate company based out of India and their brand was abused by scammers. These days, there are a lot of browser locker campaigns fueled by malvertising or redirection from hacked sites. But the Shoppers Stop tech scam campaign is actually a bit of both,...

Description of the security update for the vulnerability in Windows Server 2008, Windows Embedded POSReady 2009, and Windows Embedded Standard 2009: May 08, 2018

Description of the security update for the vulnerability in Windows Server 2008, Windows Embedded POSReady 2009, and Windows Embedded Standard 2009: May 08, 2018 Summary An elevation of privilege vulnerability and an information disclosure vulnerability exist in Windows when the Win32k component...

April 17, 2018—KB4093113 (Preview of Monthly Rollup)

None None...

CloudBees Jenkins Cross-Site Scripting Vulnerability (CNVD-2018-07822)

CloudBees Jenkins formerly known as Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . A...

Remote Control Vulnerability in MAC1100 PLCs

The MAC1100 PLC Programmable Logic Controller PLC is a product in the Dalian Computer Control DCCE Programmable Logic Controller PLC series. A remote control vulnerability exists in the MAC1100 PLC. An attacker can use the vulnerability to remotely and directly control the start and stop of the...

April 10, 2018—KB4093118 (Monthly Rollup)

None None...

April 10, 2018—KB4093108 (Security-only update)

None None...

Stop error 0xAB when you log off a Windows Server 2008 session

Stop error 0xAB when you log off a Windows Server 2008 session Symptoms After you install security update KB 4089344, you receive a Stop error 0xAB error message that resembles the following when you log off the computer: SESSIONHASVALIDPOOLONEXIT ab Important If you install a language pack after...

Stop error 0xAB when you log off a Windows Server 2012 session

Stop error 0xAB when you log off a Windows Server 2012 session Symptoms After you install Monthly Rollup KB4088877 or Security-only update KB 4088880, you receive a Stop error 0xAB error message that resembles the following when you log off the computer: SESSIONHASVALIDPOOLONEXIT ab Important If...

Stop error 0xAB when you log off a Windows 7 SP1 or Windows Server 2008 R2 SP1 session

Stop error 0xAB when you log off a Windows 7 SP1 or Windows Server 2008 R2 SP1 session Symptoms After you install Monthly Rollup KB4088875 or Security-only update KB 4088878, you receive a Stop error 0xAB error message that resembles the following when you log off the computer:...

March 23, 2018—KB4088881 (Preview of Monthly Rollup)

None None...

March 22, 2018—KB4089848 (OS Build 16299.334)

None None...

CVE-2017-18240

The Gentoo app-admin/collectd package before 5.7.2-r1 sets the ownership of PID file directory to the collectd account, which might allow local users to kill arbitrary processes by leveraging access to this account for PID file modification before a root script sends a SIGKILL when the service is...

App Layering - PVS Blue Screen SYSTEM_THREAD_EXCEPTION_NOT_HANDLED (CVhdMp.sys)

The BSOD SYSTEMTHREADEXCEPTIONNOTHANDLED CVhdMp.sys is seen when booting up a VM in PVS using an App Layering image. It is also possible to just simply get a BSOD with a Stop Code of 0x0000007B. However, this is fairly generic. If you see this stop code and "ERROR: BNIStack failed, network stack...

February 22, 2018—KB4075212 (Preview of Monthly Rollup)

None None...

old.stop-climate-change.de XSS vulnerability

Open Bug Bounty ID: OBB-555039 Description| Value ---|--- Affected Website:| old.stop-climate-change.de Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

SUSE-SU-2018:0385-1 Security update for libvirt

This update for libvirt provides several fixes. This security issue was fixed: - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead method which allowed to cause DoS bsc1076500. These security issues were fixed: - Add a qemu hook script providing functionality similar to Xen's...

ICMPExfil - Exfiltrate data with ICMP

ICMP Exfil allows you to transmit data via valid ICMP packets. You use the client script to pass in data you wish to exfiltrate, then on the device you're transmitting to you run the server. Anyone watching-- human or security system-- will just see valid ICMP packets, there's nothing malicious...

SUSE-SU-2018:0279-1 Security update for libvirt

This update for libvirt provides several fixes. This security issue was fixed: - CVE-2018-5748: Prevent resource exhaustion via qemuMonitorIORead method which allowed to cause DoS bsc1076500. These security issues were fixed: - Add a qemu hook script providing functionality similar to Xen's...