SOLDIERX.COM Nobody Can Stop Information Insemination

On Second Thought...

Re: BugTraq Shutdown

Re: [SECURITY] [DSA 4628-1] php7.0 security update

BugTraq Shutdown

News, Infocus, Columns, Vulnerabilities, Bugtraq ...

Posted by malvuln on Jul 26

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/6fab73bf104c6a9211b94f9559faa134.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Nbdd.bgz
Vulnerability: Remote Stack Buffer Overflow
Description: NetBot_Attacker VIP 5.9 on initial startup listens on port
8080 and on subsequent restarts port 80. Third-party attackers who can
reach an infected system can send...

Posted by malvuln on Jul 26

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/611dbff0d68df777c6d6881e00440143.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Bifrose.acci
Vulnerability: Local Stack Buffer Overflow
Description: Bifrost doesn't properly validate the IP address when
importing Bifrost settings (.set) files. The IP address offset is located
after a NULL byte which is...

Posted by malvuln on Jul 26

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/5817183894cb513239f6aef28895130c_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.PsyRat.b
Vulnerability: Remote Denial of Service
Description: The PsyRAT 1.02 malware listens by default on TCP port 9863.
Third-party attackers who can reach infected systems can send a specially
crafted command payload that...

Posted by malvuln on Jul 26

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/5817183894cb513239f6aef28895130c.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.PsyRat.b
Vulnerability: Unauthenticated Remote Command Execution
Description: The PsyRAT 1.02 malware listens by default on TCP port 9863,
but can be changed when building backdoor servers. Third-party attackers
who can reach...

Posted by malvuln on Jul 26

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/ce1963d3fd6a8e1383aac40a1f1c4107_C.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Agent.cu
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP ports 10426, 56185. Third-party
attackers who can reach infected systems can execute commands made
available by the backdoor....

Posted by malvuln on Jul 26

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/ce1963d3fd6a8e1383aac40a1f1c4107_B.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Agent.cu
Vulnerability: Port Bounce Scan (MITM)
Description: The malware listens on TCP ports 10426, 56185, its FTP
component accepts any username/password credentials. Third-party attackers
who successfully logon can abuse the...

Posted by malvuln on Jul 26

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/ce1963d3fd6a8e1383aac40a1f1c4107.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Agent.cu
Vulnerability: Authentication Bypass RCE
Description: The malware listens on TCP ports 10426, 56185. Third-party
attackers who can reach infected systems can logon using any
username/password combination. Intruders may then...

Posted by malvuln on Jul 26

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/6681d5e4b68abd21a14c704edf9e2ff5.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Mazben.me
Vulnerability: Unauthenticated Open Proxy
Description: The malware listens on random TCP ports like 3515, 7936, 3972.
Third-party attackers who can connect to the infected system can relay
requests from the original...

Posted by malvuln on Jul 26

Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source:
https://malvuln.com/advisory/16d598c01f7b391986c8c19eded005b1.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hupigon.aaur
Vulnerability: Unauthenticated Open Proxy
Description: The malware listens on TCP port 8080. Third-party attackers
who can connect to the infected system can relay requests from the original
connection to the...

Posted by Atlassian on Jul 26

This email refers to the advisory found at
https://confluence.atlassian.com/adminjiraserver/jira-data-center-and-jira-service-management-data-center-security-advisory-2021-07-21-1063571388.html

CVE ID:

* CVE-2020-36239

Products: Jira Data Center, Jira Core Data Center, Jira Software Data Center,
and Jira Service Management Data Center.

Affected Versions - Jira Data Center, Jira Core Data Center, and Jira Software
Data Center:

6.3.0 <=...

Posted by Georgi Guninski on Jul 26

Potential symlink attack in python3 __pycache__

Not sure if this is vulnerability, but it looks like
classical symlink attack.

In python3, if a script in directory DIR1 does "import another",
then python3 creates directory __pycache__ in DIR1 and puts
some files in __pycache__.

According to our tests, if DIR1/__pycache__ is symlink to something,
then python3 follows the symlink.

We suspect the attacker has little to no control on...

Posted by Moses Frost via Dailydave on Jul 26

I am always in shock when people cannot see the forests from the tree's even when talking to peers. First things first,
Azure AD and many IdP's are not impervious to attack. Through Oauth2 and other privilege abuse angles in the IdP
itself, backdooring systems are (and will continue to be) a thing. For those on defense, I hope you are checking on
those MS Graph enabled Service Principals while I am waving at the other end (hello)....

Posted by François Zöfel via Dailydave on Jul 26

Speaking for a heavily regulated EU business here: a US cloud based solution will most probably not fit our needs. Both
GDPR and rules about not being dependent on 3rd party businesses to conduct our own mean we’re stuck with an on-prem AD.

I’m very interested to hear about any potential alternative.

François

Le dim., juil. 25, 2021 à 07:50, Peter Bance via Dailydave <dailydave () lists aitelfoundation org> a écrit :

Dailydave...

Posted by Peter Bance via Dailydave on Jul 25

Funnily enough, I’ve just decommissioned our last Domain Controller - as you rightly say, AD is just too much pain/risk
to keep in place. Azure AD for us - still not 100% ideal, but rapidly improving, and transfers a lot of the
infrastructure/config pain to Microsoft themselves.

Obviously admins can still make horrible mistakes, but that’s easier to monitor than all config across an on-prem
forest, and it’s far simpler to limit (or even...

Posted by Dave Aitel via Dailydave on Jul 24

So I definitely have a different mental history of active directory than
most people, and recently I was doing a Glasshouse podcast with Pablo Breuer
<https://www.linkedin.com/in/pablobreuer/> and here
<https://youtu.be/Z0d6qNLevUY?t=2714> he says basically the same thing
everyone says, which is that it's impossible to move off of technology even
when that technology has a history of severe flaws, or a design flaw that
means it...