Multiple Beckhoff Products Multiple Security Bypass Vulnerabilities
Monthly Archives: October 2016
Vuln: INDAS Web SCADA CVE-2016-8343 Directory Traversal Vulnerability
INDAS Web SCADA CVE-2016-8343 Directory Traversal Vulnerability
Vuln: Dell EMC vApp Manager Multiple Arbitrary Command Execution Vulnerabilities
Dell EMC vApp Manager Multiple Arbitrary Command Execution Vulnerabilities
Vuln: IBM Business Process Manager Advanced CVE-2016-5901 Unspecified Cross Site Scripting Vulnerability
IBM Business Process Manager Advanced CVE-2016-5901 Unspecified Cross Site Scripting Vulnerability
Wireshark Analyzer 2.2.1
Wireshark is a GTK+-based network protocol analyzer that lets you capture and interactively browse the contents of network frames. The goal of the project is to create a commercial-quality analyzer for Unix and Win32 and to give Wireshark features that are missing from closed-source sniffers.
EMC Unisphere For VMAX Command Execution
The vApp Manager which is embedded in EMC Unisphere for VMAX and Solutions Enabler Virtual Appliances suffers from multiple command execution vulnerabilities. Affected include EMC Unisphere for VMAX Virtual Appliance versions 8.0.x through 8.2.x and EMC Solutions Enabler Virtual Appliance versions 8.0.x through 8.2.x.
Ubuntu Security Notice USN-3095-1
Ubuntu Security Notice 3095-1 – Taoguang Chen discovered that PHP incorrectly handled certain invalid objects when unserializing data. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. Taoguang Chen discovered that PHP incorrectly handled invalid session names. A remote attacker could use this issue to inject arbitrary session data. Various other issues were also addressed.
EMC Replication Manager / Network Module Remote Code Execution
EMC Replication Manager (RM) is affected by a remote code execution vulnerability that may be exploited by an attacker to compromise an affected system. A remote unauthenticated attacker may execute arbitrary commands on an RM Client, with high privileges, by starting a rogue RM Server that connects to the RM Client and executes the malicious script/payload that is placed in an SMB share, by the attacker, that is accessible to the RM Client. Affected include EMC Replication Manager versions prior to 5.5.3 on all supported OS, EMC Network Module for Microsoft version 3.x, and EMC Networker Module for Microsoft version 8.2.x.
Avast and AVG combine to better protect your business
We are now one company . . . whether you use an AVG or an Avast product, we will continue to offer and support both AVG and Avast branded products.
In July, we announced that we signed an agreement to acquire AVG. We have now acquired a majority stake in the company, completing the initial tender offer for all of the outstanding ordinary shares of AVG Technologies. That means we will operate as a single company as of Monday, October 3, 2016 and can officially welcome AVG business users to Avast! I have been leading Avast’s SMB business since 2015, and will drive the integration of the two company’s business divisions. With an existing SMB business and reseller base that was many times larger than Avast, we will be integrating Avast’s program into the AVG business program.
The acquisition will overnight vault Avast into a leadership position in the SMB security market. Our gain will also be your gain. By combining the strengths of Avast and AVG under one company, you can now look forward to a stronger threat detection network powered by the largest install base (by far) of any competitor. The new Avast now protects more than 400 million mobile and PC users worldwide, each of which acts as a sensor. Whenever one of these sensors encounters a new threat, the threat is sent to our Threat Labs for analysis and a detection is created to protect the rest of our network. This means your business is already being better protected from the latest threats.
Avast will continue to offer and support both the AVG and Avast branded products for the foreseeable future (more details about this can be found here). We want our customers to be reassured that whether you use an AVG product or an Avast product, we will continue to have experts support you. We are nothing without our customers and partners like you, who helped us get to where we are today.
We are thrilled about what the future will bring and are looking forward to finding new ways to add value for you, our customers. We are looking forward to the innovative products this acquisition will produce and the momentum it will create in the market.
Forward-Looking Statements
This press release contains forward-looking information that involves substantial risks and uncertainties that could cause actual results to differ materially from those expressed or implied by such statements. All statements other than statements of historical fact are, or may be deemed to be, forward-looking statements within the meaning of the federal securities laws, and involve a number of risks and uncertainties. In some cases, forward-looking statements can be identified by the use of forward-looking terms such as “anticipate,” “estimate,” “believe,” “continue,” “could,” “intend,” “may,” “plan,” “potential,” “predict,” “should,” “will,” “expect,” “are confident that,” “objective,” “projection,” “forecast,” “goal,” “guidance,” “outlook,” “effort,” “target,” “would” or the negative of these terms or other comparable terms. There are a number of important factors that could cause actual events to differ materially from those suggested or indicated by such forward-looking statements and you should not place undue reliance on any such forward-looking statements. These factors include risks and uncertainties related to, among other things: general economic conditions and conditions affecting the industries in which Avast and AVG operate; the uncertainty of regulatory approvals; the parties’ ability to satisfy the conditions to the contemplated tender offer, AVG’s delisting from the New York Stock Exchange and suspension of AVG‘s reporting obligations under the Exchange Act and to consummate the transactions and their plans described in this press release; and AVG’s performance and maintenance of important business relationships. Additional information regarding the factors that may cause actual results to differ materially from these forward-looking statements is available in AVG’s filings with the U.S. Securities and Exchange Commission, including AVG’s Annual Report on Form 20-F for the year ended December 31, 2015. These forward-looking statements speak only as of the date of this release and neither Avast nor AVG assumes any obligation to update or revise any forward-looking statement, whether as a result of new information, future events and developments or otherwise, except as required by law.
Additional Information and Where to Find It
This press release does not constitute an offer to purchase or a solicitation of an offer to sell any securities of AVG. The solicitation and offer to purchase ordinary shares of AVG is being made pursuant to a tender offer statement on Schedule TO, including an Offer to Purchase, a related letter of transmittal and certain other tender offer documents, filed by Avast with the SEC on July 29, 2016 (as subsequently amended, the “Tender Offer Statement”). AVG filed a solicitation/recommendation statement on Schedule 14D-9 with respect to the tender offer with the SEC on July 29, 2016 (as subsequently amended, the “Solicitation/Recommendation Statement”). AVG shareholders are urged to read the Tender Offer Statement and Solicitation/Recommendation Statement, as they may be amended from time to time, as well as any other relevant documents filed with the SEC, carefully and in their entirety because they will contain important information that AVG shareholders should consider before making any decision regarding tendering their securities. The Tender Offer Statement and the Solicitation/Recommendation Statement are available for free at the SEC’s website at www.sec.gov. Copies of the documents filed with the SEC by AVG will be available free of charge on AVG’s website at investors.avg.com.
Re: Critical Vulnerability in Ubiquiti UniFi
Posted by Gregory Sloop on Oct 04
I attempted private contact with Tim Pham and via email 12+ hours ago, but received no response since then.
I’ve spent some time trying to reproduce the reported vulnerability and have had no success. It certainly doesn’t help
that the steps to reproduce it are so poorly described or documented.
Without better documentation of the exploit, it seems impossible to determine if the report is just mis-informed,
blatantly false, or if…