yaracroft @venom@nanao.cybtex.fr

(CVE-2021-22156) BlackBerry QNX Real Time Operating System (RTOS) is affected by a « BadAlloc » vulnerability. A remote attacker could exploit it to cause a Denial-of-Service (DoS) condition or execute arbitrary code (RCE) on affected devices #vuln #informatique

https://us-cert.cisa.gov/ncas/alerts/aa21-229a

#Microsoft said that « it's a non-issue and they will not fix it » then, after further analysis, had decided to take this EoP problem seriously #windows #vuln #informatique

https://threatpost.com/windows-eop-bug-detailed-by-google-project-zero/168823/

A New Attack Surface on #Microsoft Exchange (Part 2) - ProxyOracle #vuln #windows

https://blog.orange.tw/2021/08/proxyoracle-a-new-attack-surface-on-ms-exchange-part-2.html

A New Attack Surface on #Microsoft Exchange (Part 1) - ProxyLogon #vuln #windows

https://blog.orange.tw/2021/08/proxylogon-a-new-attack-surface-on-ms-exchange-part-1.html

(CVE-2020-9273) PoC - ProFTPd Post-Auth Use-After-Free leading to RCE #vuln #informatique

https://github.com/lockedbyte/CVE-Exploits/tree/master/CVE-2020-9273

TeamServer.prop is an optional properties file used by the Cobalt Strike teamserver to customize the settings used to validate screenshot and keylog callback data, which allows you to tweak the fix for the « HotCobalt » vulnerability #microsoft #windows #vuln

https://blog.cobaltstrike.com/2021/08/11/teamserver-prop/

Charlie Bromberg's mindmap for common attacks operated on Active Directory authentication protocols (NTLM, Kerberos) : Pass-the-hash, Pass-the-key, Pass-the-ticket, Pass-the-cache, Overpass-the-hash, Golden ticket, Silver ticket, ASPREProast, Kerberoast, relayed captured,.. #microsoft #windows #vuln

http://thehacker.recipes/

(CVE-2020-29015) An OS command injection vulnerability in #Fortinet FortiWeb's management interface (version 6.3.11 and prior) can allow a remote, authenticated attacker to execute arbitrary commands on the system, via the SAML server configuration page #vuln #firewall #informatique #cyber #threats

https://www.rapid7.com/blog/post/2021/08/17/fortinet-fortiweb-os-command-injection/

(CVE-2021-28372) Critical Vulnerability That Affects Millions of internet-of-things (#IoT) #devices that use the ThroughTek « Kalay » network - one that exposes live video and audio streams to eavesdropping threat actors and which could enable attackers to take over control of devices, including security webcams and connected baby monitors #vuln #cyber #threats #informatique

https://www.fireeye.com/blog/threat-research/2021/08/mandiant-discloses-critical-vulnerability-affecting-iot-devices.html

(CVE-2021-21832) Memory corruption vulnerability in Daemon Tools Pro can cause memory corruption in the application if the user opens an adversary-created ISO file that causes an integer overflow. This vulnerability exists in the way the application parses ISOs. #vuln #informatique

https://blog.talosintelligence.com/2021/08/vulnerability-spotlight-memory.html

Multiple Issues in Realtek SDK Affects Hundreds of Thousands of Devices Down the #Supply Chain : At least 65 vendors affected by severe vulnerabilities that enable unauthenticated attackers to fully compromise the target device and execute arbitrary code with the highest level of privilege. #Realtek chipsets are found in many embedded #devices in the IoT space. RTL8xxx SoCs – which provide #wireless capabilities – are very common.

• CVE-2021-35392 (#WiFi Simple Config’ stack buffer overflow via UPnP)
• CVE-2021-35393 (WiFi Simple Config’ heap buffer overflow via SSDP)
• CVE-2021-35394 (MP Daemon diagnostic tool command injection)
• CVE-2021-35395 (management web interface multiple vulnerabilities #vuln #informatique

https://www.iot-inspector.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/

(CVE-2021-34473) Finding exposed OWA servers vulnerable to proxyshell - A new set of critical vulnerabilities popped-up at this year's BlackHat edition regarding #Microsoft Exchange exploitable via Outlook Web Access. This set of vulnerabilities as been dubbed proxyshell #vuln

https://www.onyphe.io/blog/finding-exposed-owa-servers-vulnerable-to-proxyshell/

PetitPotam code have been updated to use one unpatched #Microsoft Encrypting File System Remote (EFSRPC) functions if needed + added the structs and nearly all RPC calls that can be used to elicit authentication or do other interesting thing #windows #vuln #informatique

https://github.com/topotam/PetitPotam

CVE-2021-34527 (PrintNightmare) weaponized by Magniber #ransomware gang in attacks against South Korea #vuln #windows

https://therecord.media/printnightmare-vulnerability-weaponized-by-magniber-ransomware-gang/

Last month, security researcher 🇫🇷 GILLES Lionel disclosed a new method called PetitPotam that forces a Windows machine, including a #Windows domain controller, to authenticate against a threat actor's malicious NTLM relay server using the Microsoft Encrypting File System Remote Protocol (EFSRPC). This weekend, 🇺🇸 Craig Kirby shared a NETSH RPC filter that blocks remote access to the MS-EFSRPC API, effectively blocking the unauthenticated PetitPotam attack vector. According to security researcher 🇫🇷 Benjamin Delpy, you can use this filter by copying the following contents [...] #Microsoft's response to recent vulnerabilities, such as PetitPotam, SeriousSAM, and PrintNightmare have been very concerning for security researchers who feel that Microsoft is not doing enough to protect its customers #vuln #informatique

https://www.bleepingcomputer.com/news/microsoft/windows-petitpotam-attacks-can-be-blocked-using-new-method/

PwnedPiper : 9 vulnerabilities in critical infrastructure used by 80% of major hospitals in North America. Swisslog's Translogic Pneumatic Tube System (PTS), a solution that plays a crucial role in patient #care, found vulnerable to devastating attack. This research sheds light on systems that are hidden in plain sight but are nevertheless a crucial building block to modern-day #healthcare. Understanding that patient care depends not only on #medical #devices, but also on the operational #infrastructure of a #hospital is an important milestone to securing healthcare environments. #vuln #informatique #cyber #threats

https://www.armis.com/research/pwnedpiper

Detecting CVE-2021-36934 ( « SeriousSAM » ) with Splunk #vuln #informatique

https://www.splunk.com/en_us/blog/security/detecting-serioussam-cve-2021-36934-with-splunk.html

Security updates available in Foxit PDF Reader 11.0.1 and Foxit #PDF Editor 11.0.1 #vuln #windows

https://www.foxit.com/support/security-bulletins.html

CVE-2021-30807 #iOS (POC) WebContent->EL1 LPE: OOBR in AppleCLCD / IOMobileFrameBuffer #apple #vuln

https://saaramar.github.io/IOMobileFrameBuffer_LPE_POC/