Read Time:9 Second
Simon Josefsson discovered an out-of-bounds memory read in GNU SASL,
an implementation of the Simple Authentication and Security Layer
framework, which could result in denial of service.
Category Archives: Advisories
xen-4.15.3-3.fc35
Read Time:10 Second
FEDORA-2022-7bc84ae2cc
Packages in this update:
xen-4.15.3-3.fc35
Update description:
Retbleed – arbitrary speculative code execution with return instructions
[XSA-407, CVE-2022-23816, CVE-2022-23825, CVE-2022-29900]
Lightning Framework: A New Modular Malware for Linux
Read Time:1 Minute, 37 Second
FortiGuard Labs is aware of the discovery of a new Linux malware variant that is not only complex in design, but modular. Dubbed ‘Lightning Framework’, the malware consists of various modules for different functionality. At this time, there is no report of Lightning Framework being used or observed in the wild attacks.Why is this Significant?This is significant because Lightning Framework is a previously unknown modular malware for Linux that can download and install different modules (including rootkits) and plugins to a targeted machine. While there are no reports of the malware being used in the wild, it can be safely surmised that the Lightning Framework can be expected and incorporated in real attacks soon.What is Lightning Framework?Lightning Framework is a modular malware that consists of various modules for different functionality.A Lightning Framework infection starts with an installation of the Lightning.Downloader module on the compromised Linux machine. This module connects to its Command-and-Control (C2) server and is used to download other additional and plugins including Lightning.Core. Lightning.Core is the main module of Lightning Framework and is responsible for receiving commands from the C2 server and to execute remote commands. Other modules that are downloaded by Lightning.Downloader are:Linux.Plugin.Lightning.SsHijacker, Linux.Plugin.Lightning.Sshd, Linux.Plugin.Lightning.Nethogs, Linux.Plugin.Lightning.iftop, and Linux.Plugin.Lightning.iptraf.According to the Intezer blog the modules: Linux.Plugin.Lightning.SsHijacker, Linux.Plugin.Lightning.Nethogs, Linux.Plugin.Lightning.iftop, and Linux.Plugin.Lightning.iptraf are referenced only in the source and actual files have not been discovered in the wild.Furthermore, to add insult to injury – Lightning Framework can open a SSH backdoor using the Linux.Plugin.Lightning.Sshd plugin upon receiving a remote command.What is the Status of Coverage?FortiGuard Labs provides the following AV coverage against available modules and plugins of Lightning Framework:Linux/Agent.PA!trLinux/Agent.B5B5!trLinux/Agent.C492!tr
CloudMensis: a New Spyware for Mac
Read Time:1 Minute, 50 Second
FortiGuard Labs is aware of a report that a new spyware for Mac was discovered in the field. Dubbed “CloudMensis”, the spyware has been active since at least February 2022 and allows an attacker to perform various activities on a compromised machine such as capturing keystrokes, taking screenshots, downloading and executing remote files, and exfiltrating email messages and attachments.Why is this Significant?This is significant because CloudMensis is a previously unknown spyware for macOS that can perform various activities on a compromised machine. Also, CloudMensis is equipped with a feature to bypass Transparency, Consent, and Control (TCC), a security feature in Mac, to allow itself to perform nefarious actions involving sensitive data.What is CloudMensis?CloudMensis is a new spyware for macOS.According to a security vendor ESET, a downloader was deployed to the compromised Mac machine once an attacker gains an administrative access through unknown means. The downloader then downloads CloudMensis from a Cloud storage service and installs it on the targeted machine.The report indicates CloudMensis allows an attacker to perform activities such as:Downloading and executing remote filesExfiltrating email messages and attachmentsKeyloggingTaking screenshotsRunning searches in removable drivesUploading stolen information to Cloud storages in a password-protected zip fileAlso, CloudMensis is capable of bypassing Transparency, Consent, and Control (TCC), a security feature introduced in macOS 10.8 (OS X Mountain Lion), that allows the user to configure privacy settings for macOS apps. TCC usually manifests to the user in a form of a prompt window that asks the user to either allow or deny apps to perform certain actions involving sensitive information such as access to Web cams, microphones and iCloud. The TCC configuration is stored in TCC.db, which is protected by System Integrity Protection (SIP). If SIP is disabled, CloudMensis grants itself a permission by adding entries to the database. If SIP is enabled but the installed macOS version is earlier than 10.15.6, CloudMensis exploits a known vulnerability patched in July 2020 in order to add entries to the TCC database.What is the Status of Coverage?FortiGuard Labs customers with the latest (AV) definitions are protected against CloudMensis with the following coverage:OSX/Agent.BW!trAdware/CloudMensis!OSXAdware/CloudMensis
CVE-2016-15004
Read Time:18 Second
A vulnerability was found in InfiniteWP Client Plugin 1.5.1.3/1.6.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to injection. The attack can be launched remotely. Upgrading to version 1.6.1.1 is able to address this issue. It is recommended to upgrade the affected component.
CVE-2018-25045
Read Time:7 Second
Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoescaping.
openssl11-1.1.1k-4.el7
Read Time:28 Second
FEDORA-EPEL-2022-e05ac11f9b
Packages in this update:
openssl11-1.1.1k-4.el7
Update description:
backport from 1.1.1k-7: CVE-2022-2097: AES OCB fails to encrypt some bytes on 32-bit x86
Resolves: CVE-2022-2097
backport from 1.1.1k-7: Update expired certificates used in the testsuite
Resolves: rhbz#2100554
backport from 1.1.1k-7: CVE-2022-1292: openssl: c_rehash script allows command injection
Resolves: rhbz#2090371
backport from 1.1.1k-7: CVE-2022-2068: the c_rehash script allows command injection
Resolves: rhbz#2098278
podman-4.1.1-3.fc36
Read Time:10 Second
FEDORA-2022-482b42705f
Packages in this update:
podman-4.1.1-3.fc36
Update description:
Rebuild v4.1.1 to mitigate CVE-2022-{1705,32148,30631,30633,28131,30635,30632,30630,1962} in golang
CVE-2017-20139
Read Time:27 Second
A vulnerability was found in Itech Movie Portal Script 7.36. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /show_news.php. The manipulation of the argument id with the input AND (SELECT 1222 FROM(SELECT COUNT(*),CONCAT(0x71786b7a71,(SELECT (ELT(1222=1222,1))),0x717a627871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) leads to sql injection (Error). The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2017-20140
Read Time:22 Second
A vulnerability was found in Itech Movie Portal Script 7.36. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /movie.php. The manipulation of the argument f with the input <img src=i onerror=prompt(1)> leads to basic cross site scripting (Reflected). The attack may be launched remotely. The exploit has been disclosed to the public and may be used.