Read Time:6 Second
FEDORA-2022-bcc0df5180
Packages in this update:
plib-1.8.5-30.fc35
Update description:
Security fix for CVE-2021-38714
Monthly Archives: May 2022
plantuml-1.2022.5-1.fc35
Read Time:6 Second
FEDORA-2022-fda9f1f7bd
Packages in this update:
plantuml-1.2022.5-1.fc35
Update description:
Security fix for CVE-2022-1379
plantuml-1.2022.5-1.fc37
Read Time:16 Second
FEDORA-2022-ddfd750ade
Packages in this update:
plantuml-1.2022.5-1.fc37
Update description:
Automatic update for plantuml-1.2022.5-1.fc37.
Changelog
* Mon May 16 2022 Sandipan Roy <bytehackr@fedoraproject.org> – 1:1.2022.5-1
– Updated version to 1.2022.5
– Added fix for rhbz#2086392
Multiple Vulnerabilities in SonicWall SSLVPN SMA1000 Series Could Allow for Authentication Bypass
Read Time:19 Second
Multiple vulnerabilities in SonicWall SMA 1000 Series could allow for authentication bypass. Successful exploitation could allow an attacker to have unauthorized access to internal resources and even redirect potential victims to malicious websites. The SonicWall SMA 1000 Series is a unified secure access gateway that enables organizations to provide access to any application, anytime, from anywhere and any devices, including managed and unmanaged.
A vulnerability in Zyxel Firewall and VPN Could Allow for Arbitrary Code Execution
Read Time:21 Second
A vulnerability has been discovered in Zyxel Firewall and VPN, which could allow for arbitrary code execution. Zyxel is a manufacturer of networking devices that provides networking equipment globally. Successful exploitation of this vulnerability could allow for administrative access to the system, which could allow an attacker to change firewall settings, intercept traffic, create VPN accounts to gain access to the network behind the device, and perform additional administrative functions.
Upcoming Speaking Engagements
Read Time:37 Second
This is a current list of where and when I am scheduled to speak:
I’m speaking on “Securing a World of Physically Capable Computers” at OWASP Belgium’s chapter meeting in Antwerp, Belgium, on May 17, 2022.
I’m speaking at Future Summits in Antwerp, Belgium, on May 18, 2022.
I’m speaking at IT-S Now 2022 in Vienna, Austria, on June 2, 2022.
I’m speaking at the 14th International Conference on Cyber Conflict, CyCon 2022, in Tallinn, Estonia, on June 3, 2022.
I’m speaking at the RSA Conference 2022 in San Francisco, June 6-9, 2022.
I’m speaking at the Dublin Tech Summit in Dublin, Ireland, June 15-16, 2022.
The list is maintained on this page.
Friday Squid Blogging: Squidmobile
Read Time:9 Second
The Squidmobile.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Read my blog posting guidelines here.
plib-1.8.5-30.fc37
Read Time:16 Second
FEDORA-2022-89c22f2ea9
Packages in this update:
plib-1.8.5-30.fc37
Update description:
Automatic update for plib-1.8.5-30.fc37.
Changelog
* Fri May 13 2022 Hans de Goede <hdegoede@redhat.com> – 1.8.5-30
– Add 3 patches from Debian
– Fixes CVE-2021-38714 (rhbz#1997815)
Intel bets big on security as a service for confidential computing
Read Time:23 Second
Intel revealed a string of security advancements at its inaugural Intel Vision event this week, including Project Amber — a security as a service initiative for confidential computing — as well as increased collaboration for secure and responsible developments in AI, and a phased approach to quantum-safe cryptography.
Project Amber is aimed at providing organizations with remote verification of security in cloud, edge, and on-premises environments.
some details regarding CVE-2022-24422 / iDRAC VNC authentication
Read Time:24 Second
Posted by christian mock on May 13
The Dell advisory is a bit low on details, so:
The vulnerability is really just CVE-2006-2369 / CVE-2006-2450, but
wrapped in TLS (we’re in the 2020s, our auth bypasses are secure now!)
That means that your vuln scanner might or might not detect it, Nessus
for example does, but Nexpose apparently doesn’t.
It also means that metasploit’s “realvnc_41_bypass” is not directly
usable, you need to use your favorite TLS…