Category Archives: Advisories

Advisories

USN-5259-2: Cron vulnerabilities

Read Time:45 Second

USN-5259-1 fixed several vulnerabilities in Cron. This update provides
the corresponding update for Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that the postinst maintainer script in Cron unsafely
handled file permissions during package install or update operations.
An attacker could possibly use this issue to perform a privilege
escalation attack. (CVE-2017-9525)

Florian Weimer discovered that Cron incorrectly handled certain memory
operations during crontab file creation. An attacker could possibly use
this issue to cause a denial of service. (CVE-2019-9704)

It was discovered that Cron incorrectly handled user input during crontab
file creation. An attacker could possibly use this issue to cause a denial
of service. (CVE-2019-9705)

It was discovered that Cron contained a use-after-free vulnerability in
its force_rescan_user function. An attacker could possibly use this issue
to cause a denial of service. (CVE-2019-9706)

Read More

Advisories

Trojan-Ransom.LockerGoga / Code Execution

Read Time:19 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – (John Page – aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/3b200c8173a92c94441cb062d38012f6.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Ransom.LockerGoga
Vulnerability: Code Execution
Description: LockerGoga looks for and loads a DLL named “wow64log.dll” in
WindowsSystem32. Therefore, we can drop our own DLL to intercept and
terminate the malware…

Read More

Advisories

Ransom.CTBLocker / Code Execution

Read Time:19 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – (John Page – aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/de25f04dedaffde1be47ef26dc9a8176.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Ransom.CTBLocker
Vulnerability: Code Execution
Description: CTBLocker looks for and executes DLLs in its current
directory. Therefore, we can hijack a vuln DLL, execute our own code,
control and terminate the malware…

Read More

Advisories

Trojan-Ransom.Cerber / Code Execution

Read Time:20 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – (John Page – aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/ae99e6a451bc53830be799379f5c1104.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan-Ransom.Cerber
Vulnerability: Code Execution
Description: Cerber looks for and executes DLLs in its current directory.
Therefore, we can hijack a vuln DLL, execute our own code, control and
terminate the malware…

Read More

Advisories

Trojan.Ransom.Cryptowall / Code Execution

Read Time:20 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – (John Page – aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/0CFFEE266A8F14103158465E2ECDD2C1.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: Trojan.Ransom.Cryptowall
Vulnerability: Code Execution
Description: Cryptowall looks for and executes DLLs in its current
directory. Therefore, we can hijack a vuln DLL, execute our own code,
control and terminate the malware…

Read More

Advisories

REvil.Ransom / Code Execution

Read Time:20 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – (John Page – aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/4c5c1731481ea8d67ef6076810c49e00.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln

Threat: REvil.Ransom
Vulnerability: Code Execution
Description: REvil looks for and executes DLLs in its current directory.
Therefore, we can hijack a vuln DLL, execute our own code, control and
terminate the malware pre-encryption. The…

Read More

Advisories

Ransom.WannaCry / Code Execution

Read Time:20 Second

Posted by malvuln on May 05

Discovery / credits: Malvuln – (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/84c82835a5d21bbcf75a61706d8ab549.txt
Contact: malvuln13 () gmail com
Media: twitter.com/malvuln
ISR: ApparitionSec

Threat: Ransom.WannaCry
Vulnerability: Code Execution
Description: WannaCry looks for and executes DLLs in its current directory.
Therefore, we can hijack a vuln DLL, execute our own code, control and
terminate the malware…

Read More