Threat Outbreak Alert RuleID29860: Email Messages Distributing Malicious Software on July 18, 2017

Medium Alert ID: 54517 First Published: 2017 July 18 16:22 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29860 may contain the following files: Name | Siz...

CVE-2017-9811

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. By abusing the quarantine read and write operations, it is possible to elevate the privileges to root...

Code injection

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. By abusing the quarantine read and write operations, it is possible to elevate the privileges to root...

CVE-2017-9812

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312 to read arbitrary files with kluser privileges...

CVE-2017-9813

In Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312, the scriptName parameter of the licenseKeyInfo action method is vulnerable to cross-site scripting XSS...

Cross site request forgery (csrf)

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

Code injection

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312 to read arbitrary files with kluser privileges...

CVE-2017-9811

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. By abusing the quarantine read and write operations, it is possible to elevate the privileges to root...

CVE-2017-9810

There are no Anti-CSRF tokens in any forms on the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312. This would allow an attacker to submit authenticated requests when an authenticated user browses an attacker-controlled domain...

CVE-2017-9811

CVE-2017-9811 is part of a set of vulnerabilities in Kaspersky Anti-Virus for Linux File Server 8.0.3.297 (Web Management Console). Core Security reports a root-privilege elevation by abusing the kav4fs-control quarantine read/write path, enabling code execution as root via the quarantine functio...

CVE-2017-9813

CVE-2017-9813 relates to a reflected cross-site scripting vulnerability in the Kaspersky Anti-Virus for Linux File Server Web Management Console. Specifically, the scriptName parameter of the licenseKeyInfo action method is vulnerable to XSS in versions prior to Maintenance Pack 2 Critical Fix 4 ...

CVE-2017-9812

The reportId parameter of the getReportStatus action method can be abused in the web interface in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 version 8.0.4.312 to read arbitrary files with kluser privileges...

CVE-2017-9812

CVE-2017-9812 affects Kaspersky Anti-Virus for Linux File Server. The web UI’s getReportStatus endpoint accepts a reportId that can be abused via directory traversal to read arbitrary files with the kluser privileges. Core Security and related advisories corroborate a path traversal vulnerability...

CVE-2017-9810

CVE-2017-9810 affects Kaspersky Anti-Virus for Linux File Server Web Management Console (Kaspersky, 8.0.x). The root cause is absence of Anti-CSRF tokens in forms, enabling CSRF to submit authenticated requests when a user browses attacker-controlled domains. CORE-2017-0003 describes associated i...

Threat Outbreak Alert RuleID29835: Email Messages Distributing Malicious Software on July 17, 2017

Medium Alert ID: 54505 First Published: 2017 July 17 20:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29835 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID29831: Email Messages Distributing Malicious Software on July 17, 2017

Medium Alert ID: 54504 First Published: 2017 July 17 20:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29831 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID29828: Email Messages Distributing Malicious Software on July 17, 2017

Medium Alert ID: 54503 First Published: 2017 July 17 20:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29828 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID29827: Email Messages Distributing Malicious Software on July 17, 2017

Medium Alert ID: 54502 First Published: 2017 July 17 20:49 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29827 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID29841: Email Messages Distributing Malicious Software on July 14, 2017

Medium Alert ID: 54498 First Published: 2017 July 14 16:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29841 may contain the following files: Name | Siz...

Threat Outbreak Alert RuleID29838: Email Messages Distributing Malicious Software on July 14, 2017

Medium Alert ID: 54497 First Published: 2017 July 14 16:24 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29838 may contain the following files: Name | Siz...