A vulnerability which could allow for DNS poisoning attacks has been discovered in the C standard libraries uClibe and uClibe-ng, which are widely used in IoT products. DNS poisoning enables a subsequent Man-in-the-Middle scenario, which can be used to perform actions like stealing information, forcing authenticated responses, as well as installing malicious firmware.
There is currently no CVE listing, nor further details on affected products, as the research group Nozomi Networks is still working with vendors and library developers in finding a solution.
The MS-ISAC believes that due to various mitigating factors, this vulnerability does not pose an immediate threat to our member base. We would, however, like to share relevant details for your situational awareness.
Two vulnerabilities were discovered in the vhost code of DPDK, a set of
libraries for fast packet processing, which could result in denial of
service or the execution of arbitrary code.
Multiple vulnerabilities have been discovered in Mozilla Firefox and Firefox Extended Support Release (ESR), the most severe of which could allow for arbitrary code execution.
Mozilla Firefox is a web browser used to access the Internet.
Mozilla Firefox ESR is a version of the web browser intended to be deployed in large organizations.
Successful exploitation of the most severe of these vulnerabilities could allow for arbitrary code execution. Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
USN-5395-1 fixed vulnerabilities in networkd-dispatcher. Unfortunately
that update was incomplete and could introduce a regression. This update
fixes the problem.
We apologize for the inconvenience.
Original advisory details:
It was discovered that networkd-dispatcher incorrectly handled internal
scripts. A local attacker could possibly use this issue to cause a race
condition, escalate privileges and execute arbitrary code.
(CVE-2022-29799, CVE-2022-29800)
Posted by Onapsis Research via Fulldisclosure on May 04
# Onapsis Security Advisory 2022-0002: Denial of Service in SAP NetWeaver
JAVA
## Impact on Business
This vulnerability can be used by an attacker to make a Denial of Service
to SAP Netweaver Java, making HTTP server unavailable during attack
execution.
Posted by Onapsis Research via Fulldisclosure on May 04
# Onapsis Security Advisory 2022-0001: HTTP Request Smuggling in SAP Web
Dispatcher
## Impact on Business
By injecting an HTTP request as a prefix into a victim’s request, a
malicious user
is able to cause damage in different ways, such as producing a Denial of
Service by
setting an invalid request as a prefix.
It is also possible to inject a valid prefixed request that will include the
victim’s information from its original request….
