This malware report is part 1 of 2. This report is an effort to track, categorize, contain, understand root cause and infection vector of said user account/s, networked equipment or computer/s. This report pertains to all incidents reported by TIER II help desk, TIER III engineers, customer complaints or random IT Security audit/finding/pen test.
8ace29513474b3ae5ebf23335d1c8782b885f19d4f5db31bcf348fcb6e7db1b8SoftHSM is an implementation of a cryptographic store accessible through a PKCS#11 interface. You can use it to explore PKCS#11 without having a Hardware Security Module. It is being developed as a part of the OpenDNSSEC project. SoftHSM uses Botan for its cryptographic operations.
828f90bd4ff883d903d1fb7051d2c4969ee8ab2c7f11fac25ce9d963d9efacc9This proof of concept demonstrates how traffic load of a shared packet queue can be exploited as a side channel through which protected information leaks to an off-path attacker.
8ecb66a21b5290308e2faf624032d7d2c77c172dda2d82f1b64ec25123f32521The paper demonstrates how traffic load of a shared packet queue can be exploited as a side channel through which protected information leaks to an off-path attacker. The attacker sends to a victim a sequence of identical spoofed segments. The victim responds to each segment in the sequence (the sequence is reflected by the victim) if the segments satisfy a certain condition tested by the attacker. The responses do not reach the attacker directly, but induce extra load on a routing queue shared between the victim and the attacker. Increased processing time of packets traversing the queue reveal that the tested condition was true. The paper concentrates on the TCP, but the approach is generic and can be effective against other protocols that allow to construct requests which are conditionally answered by the victim.
3546c0dc78f266d98a1564272798e15179b459b412544a8b194584b94ad28904Drupal CKEditor versions 3.0 through 3.6.2 suffer from a persistent cross site scripting vulnerability that can be triggered by the addition of an event handler.
93acfce42fd57f2a4a004f9adac2686bf97ded904556c3a836bf23f10d5f3868Red Hat Security Advisory 2012-0040-01 - Part of the Native components for JBoss Enterprise Web Platform is mod_cluster, an Apache HTTP Server based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.
e6fd1ec0b530f75a6b6daecd23446724c8c8a60c299a2a0342c8b22d15a706d5Red Hat Security Advisory 2012-0039-01 - mod_cluster-native provides a native build of mod_cluster for the Apache HTTP Server. mod_cluster is an httpd-based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.
5e261361ed3cac0f341af90a4aa8354e37eeb5003e9d83b9b039bd4ac37413dcRed Hat Security Advisory 2012-0038-01 - Part of the Native components for JBoss Enterprise Application Platform is mod_cluster, an Apache HTTP Server based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.
352ae078c379313c63ebf26b9ead6063c5b8d06b03bc8fc08b62faeadd3ee32eRed Hat Security Advisory 2012-0037-01 - mod_cluster-native provides a native build of mod_cluster for the Apache HTTP Server. mod_cluster is an httpd-based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.
99e5c11ada5aaf5714419e60bf6f6775c4d6e7229d8a7a3c30580734ff9f9641Red Hat Security Advisory 2012-0036-01 - The mod_cluster native component provides a native build of mod_cluster for the Apache HTTP Server. mod_cluster is an httpd-based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.
2650ae52c3e34a3a7a3098090b937e54eb9c4cd8948b9b0ba0513ff5be2d368aRed Hat Security Advisory 2012-0035-01 - mod_cluster-native provides a native build of mod_cluster for the Apache HTTP Server. mod_cluster is an httpd-based load balancer. Like mod_jk, it uses a communication channel to forward requests from httpd to an application server node. It was found that mod_cluster allowed worker nodes to register on any virtual host, regardless of the security constraints applied to other vhosts. In a typical environment, there will be one vhost configured internally for worker nodes, and another configured externally for serving content. A remote attacker could use this flaw to register an attacker-controlled worker node via an external vhost that is not configured to apply security constraints, then use that worker node to serve malicious content, intercept credentials, and hijack user sessions.
5c6c43763222231357bc6b057d04c8b5bf0987107d56c8eae81db0dc2bdf2ed4Red Hat Security Advisory 2012-0034-01 - The IBM Java SE version 6 release includes the IBM Java 6 Runtime Environment and the IBM Java 6 Software Development Kit. This update fixes several vulnerabilities in the IBM Java 6 Runtime Environment and the IBM Java 6 Software Development Kit.
b730d20db788dec21a8ab86796105b1caed7ed02be29de44b27e89830ab9d48aRed Hat Security Advisory 2012-0033-01 - PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. It was found that the hashing routine used by PHP arrays was susceptible to predictable hash collisions. If an HTTP POST request to a PHP application contained many parameters whose names map to the same hash value, a large amount of CPU time would be consumed. This flaw has been mitigated by adding a new configuration directive, max_input_vars, that limits the maximum number of parameters processed per request. By default, max_input_vars is set to 1000.
9c9db32e862cfa8b6928da78793e959113908e1b37b6c97554c73280cfc1a07dCisco Security Advisory - Cisco Digital Media Manager contains a vulnerability that may allow a remote, authenticated attacker to elevate privileges and obtain full access to the affected system. Cisco Show and Share is not directly affected by this vulnerability. However, because Cisco Show and Share relies on Cisco Digital Media Manager for authentication services, attackers who compromise the Cisco Digital Media Manager may gain full access to Cisco Show and Share. Cisco has released free software updates that address this vulnerability. There are no workarounds that mitigate this vulnerability.
41922785a720c613a90f99296a1cc0323338764101e0f5f2209925f0a85b77b0Cisco Security Advisory - Cisco TelePresence Software version TE 4.1.0 contains a default account vulnerability that could allow an unauthenticated, remote attacker to take complete control of the affected device. The vulnerability is due to an architectural change that was made in the way the system maintains administrative accounts. During the process of upgrading a Cisco IP Video Phone E20 device to TE 4.1.0, an unsecured default account may be introduced. An attacker who is able to take advantage of this vulnerability could log in to the device as the root user and perform arbitrary actions with elevated privileges. Cisco has released free software updates that address this vulnerability. Workarounds that mitigate this vulnerability are available.
ffb1d743fb5b8c8144fab300e2c6dac3949900703a0d6ed2e8f35f376fc930c6OneOrZero AIMS version 2.8.0 Trial build 231211 suffers from a cross site scripting vulnerability.
3eba4b2fef00005f59a4f4b373637c3b09b89f908851ea13ba4e56f4e4aac5edDACS is a light-weight single sign-on and role-based access control system providing flexible, modular authentication methods and powerful, transparent rule-based authorization checking for Web services, CGI programs, or virtually any program.
52ed8037ddff56acd609c77ef50a3e185639fcd0760a8e857bd73d7902c0d70bThe deV!L`z Clanportal version 1.5.5 Moviebase add-on suffers from a remote SQL injection vulnerability.
6d5a7924a34b72b16edc5519639f6524b61aa185cc5047a781541906f69889c4The deV!L`z Clanportal Gamebase add-on suffers from a remote SQL injection vulnerability.
3492ac0e196fec26a595040d9c4171120263e3306bf97c75e457afec9ed34b8dpGB version 2.12 suffers from a remote SQL injection vulnerability.
249b134c21e78e3d3b7b6f54045a954016e5e010e436f08262c3feaafc1f2029Mandriva Linux Security Advisory 2012-009 - Eval injection in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor. The updated packages have been patched to correct this issue.
1ed9b98070f25427b9137f8a911e285f4f63d3447e23151f7c77cfbfd67e5d60EasyPage suffers from a remote SQL injection vulnerability.
2156de367c4422b26e28a99d242135fb678966abe467e14cf4d467c56f79b4b5Mandriva Linux Security Advisory 2012-008 - Off-by-one error in the decode_xs function in Unicode/Unicode.xs in the Encode module before 2.44, as used in Perl before 5.15.6, might allow context-dependent attackers to cause a denial of service via a crafted Unicode string, which triggers a heap-based buffer overflow. Eval injection in the Digest module before 1.17 for Perl allows context-dependent attackers to execute arbitrary commands via the new constructor. The updated packages have been patched to correct these issues.
31921fc8f107ce4afda30bef36a4fdcf306d5051fd01ee828a54c2b3c8eba137Azp Design suffers from a remote SQL injection vulnerability.
d0bac5f64c87b54d6f279906dbf58a4898a89a0dd76a4b0babdfa791a459ee0eArt and Soul Design suffers from a remote SQL injection vulnerability.
d483c323a5fc09a6f2c098f8c7fdb604a109cf50408b4ef5631eda4b579834f0
© 2022 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed