TAU Threat Discovery: Conti Ransomware

Conti is a new family of ransomware observed in the wild by the Carbon Black Threat Analysis Unit TAU. Unlike most ransomware, Conti contains unique features that separate it in terms of performance and focus on network-based targets. Conti uses a large number of independent threads to perform...

ALPINE-CVE-2020-15565

An issue was discovered in Xen through 4.13.x, allowing x86 Intel HVM guest OS users to cause a host OS denial of service or possibly gain privileges because of insufficient cache write-back under VT-d. When page tables are shared between IOMMU and CPU, changes to them require flushing of both...

SUSE-SU-2020:1842-1 Security update for systemd

This update for systemd fixes the following issues: - CVE-2019-20386: Fixed a memory leak when executing the udevadm trigger command bsc1161436. - Renamed the persistent link for ATA devices bsc1164538 - shared/install: try harder to find enablement symlinks when disabling a unit bsc1157315 -...

OSV-2020-425 Heap-buffer-overflow in ihevcd_parse_coding_unit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=17055 Crash type: Heap-buffer-overflow READ 1 Crash state: ihevcdparsecodingunit ihevcdparsecodingquadtree ihevcdparsecodingquadtree...

PT-2020-22399

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow WRITE 1 crash has been reported. The crash involves the functions ihevcd parse slice data, ihevcd nal unit, and ihevcd decode. No...

PT-2020-22317

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description A heap-buffer-overflow READ 1 crash has been reported. The crash involves the ihevcd parse coding unit, ihevcd parse coding quadtree functions...

PT-2020-22298

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a stack-buffer-overflow crash. Technical details include a crash type of Stack-buffer-overflow WRITE 4, and the crash state involve...

CVE-2020-10628

ControlEdge PLC R130.2, R140, R150, and R151 and RTU R101, R110, R140, R150, and R151 exposes unencrypted passwords on the network...

CVE-2020-10624

ControlEdge PLC R130.2, R140, R150, and R151 and RTU R101, R110, R140, R150, and R151 exposes a session token on the network...

Honeywell ControlEdge PLC and ControlEdge RTU Information Disclosure Vulnerability

Honeywell ControlEdge PLC and ControlEdge RTU are both products of Honeywell, Inc. The ControlEdge PLC is a programmable logic controller PLC.The ControlEdge RTU is a remote terminal unit RTU. An information disclosure vulnerability exists in the Honeywell ControlEdge PLC and RTU, which can be...

Honeywell ControlEdge PLC and ControlEdge RTU Information Disclosure Vulnerability (CNVD-2020-37479)

Honeywell ControlEdge PLC and ControlEdge RTU are both products of Honeywell, Inc. The ControlEdge PLC is a programmable logic controller PLC.The ControlEdge RTU is a remote terminal unit RTU. An information disclosure vulnerability exists in the Honeywell ControlEdge PLC and RTU that can be...

PT-2020-12028

Name of the Vulnerable Software and Affected Versions MiR robot controllers central computation unit version Ubuntu 16.04.2 Description The MiR robot controllers' central computation unit uses Ubuntu 16.04.2, an operating system initially designed for desktop use, which presents insecure defaults...

Schneider Electric Easergy T300 Information Disclosure Vulnerability (CNVD-2021-21474)

The Schneider Electric Easergy T300 is a remote terminal unit for the power industry from Schneider Electric, France. An information disclosure vulnerability exists in the Schneider Electric Easergy T300 using firmware version 1.5.2 and earlier, which can be exploited by an attacker to obtain...

Unspecified Vulnerability in Schneider Electric Easergy T300 (CNVD-2021-21480)

The Schneider Electric Easergy T300 is a remote terminal unit for the power industry from Schneider Electric, France. A security vulnerability exists in the Schneider Electric Easergy T300 using firmware version 1.5.2 and earlier, which can be exploited by an attacker...

bind security update

32:9.11.4-16.P2.6 - Fix EDNS512 loops on broken servers 32:9.11.4-16.P2.5 - Add CVE tests to codebase 32:9.11.4-16.P2.4 - Limit number of queries triggered by a request CVE-2020-8616 - Fix invalid tsig request CVE-2020-8617 32:9.11.4-16.P2.3 - Disable atomic operations on ppc64, ppc64le, aarch64,...

Siemens Ktk Uncontrolled Resource Consumption

A vulnerability has been identified in KTK ATE530S All versions, SIDOOR ATD430W All versions, SIDOOR ATE530S COATED All versions, SIDOOR ATE531S All versions, SIMATIC ET 200SP Open Controller CPU 1515SP PC incl. SIPLUS variants All versions = V4.2, SIMATIC ET200SP IM155-6 MF HF All versions,...

ipmitool: Buffer overflow in read_fru_area_section function in lib/ipmi_fru.c

A flaw was found in several functions of the IPMItool, where it failed to check data received from a LAN properly. An attacker could use this flaw to craft payloads, which can lead to a buffer overflow and also cause memory corruption, a denial of service, and remote code execution...

TAU Technical Report: New Attack Combines TinyPOS With Living-off-the-Land Techniques for Scraping Credit Card Data

In April of 2020 VMware Carbon Black Threat Analysis Unit TAU researchers worked with an Incident Response IR partner on a piece of malware that was discovered during an ongoing PCI investigation. The combined analysis showed that attackers who previously leveraged a malware family called TinyPOS...

Hoaxcalls Botnet Exploits Symantec Secure Web Gateways

Cyberattackers are targeting a post-authentication remote code-execution vulnerability in Symantec Secure Web Gateways as part of new Mirai and Hoaxcalls botnet attacks. Hoaxcalls first emerged in late March, as a variant of the Gafgyt/Bashlite family; it’s named after the domain used to host its...

CVE-2020-12834

eQ-3 Homematic Central Control Unit CCU2 through 2.51.6 and CCU3 through 3.51.6 allow Remote Code Execution in the JSON API Method ReGa.runScript, by unauthenticated attackers with access to the web interface, due to the default auto-login feature being enabled during first-time setup or factory...