science and technology

CVE-2024-50386: Apache CloudStack: Directly downloaded templates can be used to abuse KVM-based infrastructure

Posted by Daniel Augusto Veronezi Salvador on Nov 12

Severity: important

Affected versions:

- Apache CloudStack 4.0.0 through 4.18.2.4
- Apache CloudStack 4.19.0.0 through 4.19.1.2

Description:

Account users in Apache CloudStack by default are allowed to register templates to be downloaded directly to the
primary storage for deploying instances. Due to missing validation checks for KVM-compatible templates in CloudStack
4.0.0 through 4.18.2.4 and 4.19.0.0 through 4.19.1.2, an attacker that...




science and technology

Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets

Posted by Solar Designer on Nov 12

NIST doesn't appear to provide their own CVSS vectors/scores lately.
However, they republish (with attribution) some third-party ones, this
time from CISA-ADP. The CISA-ADP CVSS vector for this vulnerability
specifies that it not only is network-reachable, but also that it has
High impact not only on Availability, but also on Confidentiality and
Integrity. This results in a CVSSv3.1 score of 9.8. Even merely
correcting the vector not to...




science and technology

Re: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets

Posted by Clemens Lang on Nov 12

Hi,

I think the source for the CISA-ADP data is at [1]. For this specific CVE, the relevant file would be [2]. Their readme
has a section at the bottom, where they encourage feedback:

I’m aware of at last one prior case where a similar case of (IMHO) overblown CVSS scores was discussed in an issue on
this particular GitHub project [3].

Somebody seems to already have opened a ticket for this CVE, too: [4]

[1]:...




science and technology

RE: CVE-2024-36905: Linux kernel: Divide-by-zero on shutdown of TCP_SYN_RECV sockets

Posted by Joel GUITTET on Nov 12

Hello
First thanks to Alexander for reposting because I was not able to do so!
You're right Clemens, I have myself ask the question on this github
(https://github.com/cisagov/vulnrichment/issues/130), but still no information for the moment.
Joel




science and technology

Re: Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables

Posted by Andrew Cooper on Nov 12

Data are leaked into the PVShim guest, but it is the shim Xen
(exclusively) which has access to the ACPI tables.

The guest which has been shim'd can't architecturally access the leaked
data.

~Andrew





science and technology

Re: shell wildcard expansion (un)safety

Posted by Ali Polatel on Nov 12

Thank you. Around six months ago I added a restriction on filenames with
control characters to Sydbox[1] after I had read about a vulnerability
here on this list. I think it was about tar but my memory may not serve
me right. Sydbox is secure by default, so at first this feature was
enabled without any way to turn it off. After a few months of testing
with fellow Exherbo Linux developers, we have noticed some package tests
(nvim was one of them)...




science and technology

Re: Xen Security Advisory 464 v2 (CVE-2024-45819) - libxl leaks data to PVH guests via ACPI tables

Posted by Demi Marie Obenour on Nov 12

Is this unconditional (perhaps because the relevant data gets zeroed out
by the shim), or does it only apply when the PV guest can't extract data
from the shim's memory? For instance, 32-bit PV guests aren't security
supported anymore, but the PV shim isn't supposed to rely on the
security of the shim itself, only of the rest of the system.




science and technology

CVE-2024-52533: Buffer overflow in socks proxy code in glib < 2.82.1

Posted by Alan Coopersmith on Nov 12

Another CVE was issued by Mitre yesterday for another bug listed on
https://gitlab.gnome.org/Teams/Releng/security/-/wikis/home

https://gitlab.gnome.org/GNOME/glib/-/issues/3461 reports that:
"set_connect_msg() receives a buffer of size SOCKS4_CONN_MSG_LEN but it writes
up to SOCKS4_CONN_MSG_LEN + 1 bytes to it. This is because SOCKS4_CONN_MSG_LEN
doesn't account for the trailing nul character that set_connect_msg() appends...




science and technology

Re: Hi all! (and a snort sig question)

Posted by Al Lewis (allewi) via Snort-sigs on Oct 10

Wouldnt it be easier to just use the IP variable?

i.e replace the EXTERNAL_NET and use a variable or IP?

Albert Lewis

Email: allewi () cisco com<mailto:allewi () cisco com>

________________________________
From: Snort-sigs <snort-sigs-bounces () lists snort org> on behalf of Rob Vandenbrink via Snort-sigs <snort-sigs ()
lists snort org>
Sent: Thursday, October 10, 2024 12:12 PM
To: Snort User <snort.user () gmail com>...




science and technology

Snort Subscriber Rules Update 2024-10-10

Posted by Research via Snort-sigs on Oct 10

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the malware-cnc and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




science and technology

Snort Subscriber Rules Update 2024-10-15

Posted by Research via Snort-sigs on Oct 15

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the file-image,
malware-cnc, malware-other, os-windows and server-mail rule sets to
provide coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




science and technology

Snort Subscriber Rules Update 2024-10-17

Posted by Research via Snort-sigs on Oct 17

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the policy-other and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




science and technology

Questions about IPS-Policy

Posted by Bestell_E-Mail via Snort-sigs on Oct 22

Hello.

First of all, please excuse me if this question is asked a lot.

I am a beginner and currently using the IPS Policy with the Business License.

I am not sure if Personal or Business License is right for me. Are the IPS policies different in any way for these two
licenses?

Best regards

Waldemar Sager_______________________________________________
Snort-sigs mailing list
Snort-sigs () lists snort org...




science and technology

Snort Subscriber Rules Update 2024-10-22

Posted by Research via Snort-sigs on Oct 22

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the and server-webapp
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




science and technology

Remove this email address

Posted by Jose Dominguez via Snort-sigs on Oct 22

Please remove this email address from future notifications




science and technology

Re: Remove this email address

Posted by Joel Esler via Snort-sigs on Oct 23

Thank you for writing in.

Go to this URL to change user options or unsubscribe:
https://lists.snort.org/mailman/listinfo/snort-sigs

or by sending an email to snort-sigs-leave () lists snort org

Thanks!




science and technology

Snort Subscriber Rules Update 2024-10-24

Posted by Research via Snort-sigs on Oct 24

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the file-multimedia,
malware-cnc, protocol-snmp and server-webapp rule sets to provide
coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




science and technology

Snort Subscriber Rules Update 2024-10-29

Posted by Research via Snort-sigs on Oct 29

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-firefox,
malware-cnc, malware-other, os-linux and server-webapp rule sets to
provide coverage for emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




science and technology

possible false positive for 'INDICATOR-SHELLCODE x86 setgid 0' can someone confirm

Posted by John via Snort-sigs on Oct 29

When I attempt to download the following xz file, my IPS blocks it with the below populating the snort log. I suspect
this is a false positive unless there is some code in the xz file that is truly malicious. Can someone with more
knowledge about the rule please comment?

Link to file that triggers the match:
http://fl.us.mirror.archlinuxarm.org/armv7h/extra/qt5-base-5.15.15%2Bkde%2Br136-1-armv7h.pkg.tar.xz

Entry from snort log:...




science and technology

Snort Subscriber Rules Update 2024-10-31

Posted by Research via Snort-sigs on Oct 31

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the malware-cnc,
malware-other and server-other rule sets to provide coverage for
emerging threats from these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




science and technology

Snort Subscriber Rules Update 2024-11-04

Posted by Research via Snort-sigs on Nov 04

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the and server-webapp
rule sets to provide coverage for emerging threats from these
technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




science and technology

Snort Subscriber Rules Update 2024-11-07

Posted by Research via Snort-sigs on Nov 07

Talos Snort Subscriber Rules Update

Synopsis:
This release adds and modifies rules in several categories.

Details:
Talos has added and modified multiple rules in the browser-plugins and
server-webapp rule sets to provide coverage for emerging threats from
these technologies.

For a complete list of new and modified rules please see:

https://www.snort.org/advisories




science and technology

Snort Subscriber Rules Update 2024-11-12

Posted by Research via Snort-sigs on Nov 12

Talos Snort Subscriber Rules Update

Synopsis:
Talos is aware of vulnerabilities affecting products from Microsoft
Corporation.

Details:
Microsoft Vulnerability CVE-2024-43451:
A coding deficiency exists in Microsoft Windows SmartScreen that may
lead to spoofing.

Rules to detect attacks targeting these vulnerabilities are included in
this release and are identified with:
Snort 2: GID 1, SIDs 62022 through 62023,
Snort 3: GID 1, SID 300612....




science and technology

Website launched

Our new website has been launched today. Tell your visitors why you have started a new presentation and how it benefits them. Mention your goals and project advantages. Try to briefly give your visitors reasons why they should return to your pages.




science and technology

Visitors notice

Let your visitors know about news and events on your website as often as possible. You need to keep your website up-to-date so that your visitors will get used to visiting your pages regularly. You can use RSS feeds to deliver new articles directly to your readers.




science and technology

Nmap 26th Birthday Announcement: Version 7.94

Posted by Gordon Fyodor Lyon on Sep 01

Dear Nmap community,

Today is Nmap’s 26th birthday, which reminded me that I hadn’t yet
announced our Nmap 7.94 release from May. And it’s a great one! The biggest
improvement was the Zenmap and Ndiff upgrades from the obsolete Python 2
language to Python 3 on all platforms. Big thanks to Daniel Miller, Jakub
Kulík, Brian Quigley, Sam James, Eli Schwartz, Romain Leonard, Varunram
Ganesh, Pavel Zhukov, Carey Balboa, and Hasan Aliyev for...




science and technology

Npcap Celebrates its 10th Anniversary In Space!

Posted by Gordon Fyodor Lyon on Oct 05

Dear Nmap community,

Last month we celebrated Nmap's 26th birthday and today I'm happy to share
another big milestone: Our Npcap driver for capturing and sending raw
packets on Windows turned 10 this year! From humble beginnings as a
security and modernization patch for the discontinued WinPcap project,
Npcap has become an indispensable component for both Nmap and Wireshark.
And it's used by hundreds of other software products and...




science and technology

Nmap 7.95 released: OS and service detection signatures galore!

Posted by Gordon Fyodor Lyon on May 05

Dear Nmap Community,

I just arrived in San Francisco for the RSA conference and am delighted to
announce our Nmap Version 7.95 release! I'm most excited that we finally
tackled our backlog of OS and service detection fingerprint submissions.
We're not talking about dozens or hundreds of them-we processed more than
6,500 fingerprints!

For OS detection, we added 336 signatures, bringing the new total to 6,036.
Additions include iOS 15...




science and technology

[PATCH 0/1] Updated ALPN IDs (Mon, 26 Aug 2024 17:55:25 GMT)

Posted by Ariel Otilibili on Sep 15

Hello,

Herewith the PR containing this patch: https://github.com/nmap/nmap/pull/2939

Have a good week,
Ariel

Ariel Otilibili (1):
Updated ALPN IDs

scripts/tls-alpn.nse | 2 ++
1 file changed, 2 insertions(+)




science and technology

[PATCH 1/1] Updated ALPN IDs

Posted by Ariel Otilibili on Sep 15

```
$ URL=https://www.iana.org/assignments/tls-extensiontype-values/alpn-protocol-ids.csv
$ curl -sL ${URL} |
perl -nE 'say $& if /(?<="").*(?="")/' |
sort > iana;
< scripts/tls-alpn.nse perl -nE 'say $& if m!(?<=")[w/.-]+(?=",)!' |
sort > nmap.alpn;
diff iana nmap.alpn | grep '<'

< co
< postgresql

$ curl --silent ${URL} --output...




science and technology

How to make a minimal HTTPS request with ncat --ssl with explicit HTTP content?

Posted by Ciro Santilli OurBigBook via dev on Sep 17

Hello, I was trying for fun to make an HTTPS request with explicit hand-written HTTP content.

Something analogous to:

printf 'GET / HTTP/1.1 Host: example.com ' | ncat example.com 80

but for HTTPS. After Googling one of the tools that I found that seemed it might do the job was ncat from the nmap
project, so I tried:

printf 'GET / HTTP/1.1 Host: example.com ' | ncat --ssl example.com 443

an that works...




science and technology

[PATCH 0/1] Improved the legibility of Makefile

Posted by Ariel Otilibili on Sep 17

Hello committers,

The same patch is on this PR: https://github.com/nmap/nmap/pull/2938

Have a good weekend,
Ariel

Ariel Otilibili (1):
Improved the legibility of `Makefile`

Makefile.in | 14 +++-----------
1 file changed, 3 insertions(+), 11 deletions(-)




science and technology

[PATCH 1/1] Improved the legibility of `Makefile`

Posted by Ariel Otilibili on Sep 17

* source files obtained by a wildcard
* headers and objects generated by differences.

```
$ grep -P '(SRCS|HDRS|OBJS) =' Makefile.in |
sed -e 's/^export.*= //g; s/$.*//g; s/OBJS = //' |
sed -ne '2p' |
tr ' ' ' ' |
sed -e 's/.h//' |
sort -d |
grep -vP '^$' > headers

$ grep -P '(SRCS|HDRS|OBJS) =' Makefile.in |
sed -e...




science and technology

NPCAP 1.60 high CPU usage with pcap filter that does not pass anything (Win10)

Posted by Vladimir Soldatov on Sep 17

Hi guys,

I've a setup (Win10, Intel X520, NPCAP 1.60) with relatively high traffic
around 700 Mbit/s and I am trying to test the following cases:
1. Capture everything with empty pcap filter and just print stats with some
period calculating captured data size
2. Capture nothing with an intentionally created filter that does not match
the received traffic at all.
3. Capture some subset of traffic like 10%.

In all the cases, CPU usage...




science and technology

Nmap PR #2909

Posted by Vahagn Vardanian via dev on Sep 17

Hello there,
My name is Vahagn, and I am the co-founder and CTO of RedRays.
A few weeks ago, we created a pull request to Nmap Github to add a new
check for detecting the most popular information disclosure in SAP systems.

You can get list of SAp systems using this google dork: inurl:/irj/portal
Thank you




science and technology

NSE scripts for SNMPv3?

Posted by Johan Kuuse on Oct 03

Hi, my first mail to this list,

I have used (and modified) quite a few NSE scripts for SNMP.
Anyhow, AFAIK, all SNMP scripts (except "snmp-info") are limited to SNMPv1
and SNMPv2c:

nmap --script-help=snmp* | grep -B3 -A1 -i v3
----------------------------------
snmp-info
Categories: default version safe
https://nmap.org/nsedoc/scripts/snmp-info.html
Extracts basic information from an SNMPv3 GET request. The same probe is
used
here...




science and technology

NSConnection Probe

Posted by Harrison Neal on Oct 11

Good day,

It appears that nmap doesn't currently recognize TCP-bound NSConnection (
https://developer.apple.com/documentation/foundation/nsconnection ).

Example server code:

NSConnection *a = [NSConnection connectionWithReceivePort:[[NSSocketPort
alloc] init] sendPort:nil];
[a setRootObject:[[NSObject alloc] init]];
[a runInNewThread];
[NSThread sleepForTimeInterval:300.0f];

Example client code:

NSLog(@"%@ ", [[NSConnection...




science and technology

Re: NSConnection Probe

Posted by Harrison Neal on Oct 11

Apologies, it looks like the probe suggestion was cut off now that I
re-read it.

Probe TCP NSConnection_rootProxy...




science and technology

Re: Nmap PR #2909

Posted by Sinan Doğan on Oct 21

thanks

Vahagn Vardanian via dev <dev () nmap org>, 17 Eyl 2024 Sal, 18:59 tarihinde
şunu yazdı:




science and technology

Regarding NMAP Retrigger for snmp-sysdescr

Posted by Ramu Burra via dev on Oct 31

Hi Daniel & NMAP team,

I hope this email finds you well.

I'm writing to inquire about the specific behaviour of Nmap's SNMP-SYSDescr query in situations where the target device
responds intermittently.

I'm particularly interested in knowing if there are any specific configuration options or techniques that can be
employed to increase the likelihood of successful SNMP-SYSDescr queries, especially when dealing with...




science and technology

Re: Regarding NMAP Retrigger for snmp-sysdescr

Posted by Daniel Miller on Oct 31

Ramu,

Nmap's snmp-sysdescr script currently uses a 5-second timeout and attempts
only once to send the SNMPv1 request. We agree that this could be improved
to provide better reliability. I will investigate further and respond again
with specific suggestions.

Dan




science and technology

crash

Posted by Tim Millard on Oct 31

Version: 7.94+SVN
TypeError: Couldn't find foreign struct converter for 'cairo.Context'

Ubuntu 24.04.01




science and technology

crash report

Posted by Dmitriy Solodunenko on Oct 31

Ubuntu 24.04
Version: 7.94+SVN
TypeError: Couldn't find foreign struct converter for 'cairo.Context'




science and technology

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management

Posted by CISA on Mar 21

Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA and NSA Release Enduring Security Framework Guidance on Identity and Access Management [...




science and technology

CISA Releases Eight Industrial Control Systems Advisories

Posted by CISA on Mar 21

Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA Releases Eight Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/21/cisa-releases-eight-industrial-control-systems-advisories ]
03/21/2023 08:00 AM...




science and technology

CISA Releases Six Industrial Control Systems Advisories

Posted by CISA on Mar 23

Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated, and is now available.

CISA Releases Six Industrial Control Systems Advisories [
https://www.cisa.gov/news-events/alerts/2023/03/23/cisa-releases-six-industrial-control-systems-advisories ] 03/23/2023
08:00 AM EDT...




science and technology

Apple Releases Security Updates for Multiple Products

Posted by CISA on Mar 28

Cybersecurity and Infrastructure Security Agency (CISA) - Defend Today, Secure Tomorrow

You are subscribed to Cybersecurity Advisories for Cybersecurity and Infrastructure Security Agency. This information
has recently been updated and is now available.

Apple Releases Security Updates for Multiple Products [
https://www.cisa.gov/news-events/alerts/2023/03/28/apple-releases-security-updates-multiple-products ] 03/28/2023 01:00
PM EDT

Apple...




science and technology

First blog

Our new blog has been launched today. Stay focused on it and we will try to keep you informed. You can read new posts on this blog via the RSS feed.




science and technology

Clams offer clues about the Little Ice Age

-- Delivered by Feed43 service