Monthly Archives: July 2015

Avast

Patches from Adobe, Oracle, and Microsoft released

Avast Software Updater helps you apply software updates.

Earlier this week, we told our readers about the three Flash Player zero-day vulnerabilities that were found in stolen files that were leaked from the Hacking Team. We advised Avast users to disable Flash until the bugs are fixed.

It doesn’t look good for Flash. Because of the continuing security problems facing the 20-year old platform, Google and Mozilla each announced this week that their Web browsers will eventually be dropping default support for Adobe Flash, and Facebook’s new security chief wants to kill Flash. For now you can still use it, but the reports of it’s death are not greatly exaggerated…

Adobe has released security patches for Windows, Mac OS X, and Linux. Adobe Flash Player installed with Google Chrome will be automatically updated to the latest Google Chrome version. Users of Internet Explorer 10 and 11 for Windows 8.x will be automatically updated to the latest version.

Another Hacking Team zero-day vulnerability was discovered in Microsoft’s Internet Explorer. Microsoft released a total of 14 security bulletins, 4 ‘critical’ and the remainder ‘important’ in their July Security Bulletin.

And finally, Oracle released a security update to fix the Java zero-day exploit reportedly used to attack military and defense contractors from the U.S. and spy on NATO members. The Critical Patch Update Advisory also includes 193 new security updates; 99 of which could be exploited by remote attackers.

Avast Software Updater can help you with most software updates. To find it, open your Avast user interface. Click Scan on the left side, then choose Scan for outdated software. You an then decide how to proceed.

Avast Software Updater shows you an overview of all your outdated software applications

Avast Software Updater shows you an overview of all your outdated software applications

Follow Avast on Facebook, Twitter, YouTube, and Google+ where we keep you updated on cybersecurity news every day.

 

Full Disclosure

weblogin software cross site request

Posted by Juan Martinez on Jul 17

Hi, People i discover a cross site request in this
Dork: intitle:weblogin intext:”This page will redirect you to:”

This cross site request is exploit like this example:
http://target/Login:%20Weblogin%20%20This%20page%20will%20redirect%20you%20to<%20
inject any word you want to screen in the webpage>. Or another Poc is for
example:
http:target?referer=<inject the word or number you want to like view in the
page….>.
I…

Full Disclosure

OpenSSH keyboard-interactive authentication brute force vulnerability (MaxAuthTries bypass)

Posted by king cope on Jul 17

OpenSSH has a default value of six authentication tries before it will
close the connection (the ssh client allows only three password
entries per default).

With this vulnerability an attacker is able to request as many
password prompts limited by the “login graced time” setting, that is
set to two minutes by default.

Especially FreeBSD systems are affected by the vulnerability because
they have keyboard-interactive authentication enabled…

Full Disclosure

Remote file upload vulnerability in mailcwp v1.99 wordpress plugin

Posted by Larry W. Cashdollar on Jul 17

Title: Remote file upload vulnerability in mailcwp v1.99 wordpress plugin
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-09
Download Site: https://wordpress.org/plugins/mailcwp/
Vendor: CadreWorks Pty Ltd
Vendor Notified: 2015-07-09 fixed in v1.110
Vendor Contact: Contact Page via WP site
Description: MailCWP, Mail Client for WordPress. A full-featured mail client plugin providing webmail access through
your WordPress blog or website….

Full Disclosure

1503A – Chrome – ui::AXTree::Unserialize use-after-free

Posted by Berend-Jan Wever on Jul 17

T*L;DR*
After 60 day deadline has passed, I am releasing details on an unfixed
use-after-free vulnerability in Chrome’s accessibility features, which are
disabled by default. The issue does not look exploitable.

*More details*
http://berendjanwever.blogspot.nl/2015/07/1503a-chrome-uiaxtreeunserialize-use.html

*Chromium bug*https://code.google.com/p/chromium/issues/detail?id=479743

Cheers,

SkyLined

—- Gratuitous ASCII…

Security

SysAid Help Desk 'rdslogs' Arbitrary File Upload

This Metasploit module exploits a file upload vulnerability in SysAid Help Desk v14.3 and v14.4. The vulnerability exists in the RdsLogsEntry servlet which accepts unauthenticated file uploads and handles zip file contents in a insecure way. Combining both weaknesses a remote attacker can accomplish remote code execution. Note that this will only work if the target is running Java 6 or 7 up to 7u25, as Java 7u40 and above introduce a protection against null byte injection in file names. This Metasploit module has been tested successfully on version v14.3.12 b22 and v14.4.32 b25 in Linux. In theory this module also works on Windows, but SysAid seems to bundle Java 7u40 and above with the Windows package which prevents the vulnerability from being exploited.

Security

SysAid Help Desk Administrator Portal Arbitrary File Upload

This Metasploit module exploits a file upload vulnerability in SysAid Help Desk. The vulnerability exists in the ChangePhoto.jsp in the administrator portal, which does not handle correctly directory traversal sequences and does not enforce file extension restrictions. You need to have an administrator account, but there is a Metasploit auxiliary module that can create one for you. This Metasploit module has been tested in SysAid v14.4 in both Linux and Windows.