Description: The xfrm_replay_verify_len function in net/xfrm/xfrm_user.c in the Linux kernel through 4.10.6 does not validate certain size data after an XFRM_MSG_NEWAE update, which allows local users to obtain root privileges or cause a denial of service (heap-based out-of-bounds access) by leveraging the CAP_NET_ADMIN capability, as demonstrated during a Pwn2Own competition at CanSecWest 2017 for the Ubuntu 16.10 linux-image-* package 4.8.0.41.52. Impact: Local attackers may exploit...
Read More
ENDORSED AT THE INTERNATIONAL CYBERSECURITY CONFERENCE HELD ON 9 MARCH 2017 The participants of the International cybersecurity conference meeting at Bangladesh Computer Council in Dhaka, Bangladesh, on 9 March 2017, REAFFIRMING the commitments set out in the ‘Vision 2021’ to build Digital Bangladesh and transform Bangladesh into a fast developing Middle Income Country by 2021 and to mainstream ICTs as a pro-poor tool to eradicate...
Read More
The government has adopted a cyber-security declaration 2017 asking organizations to develop actionable cyber security road maps to be approved and monitored by the top management. The declaration, signed by honorable State Minister for ICT Zunaid Ahmed Palak, was released on Thursday. It has been prepared and adopted at the end of the international cyber security conference which was held in Dhaka on March 9....
Read More
The CIRT team of Bangladesh Computer Council is increasingly creating awareness of the need to seriously address the daunting challenges of protecting their information networks, especially those related to national security and critical infrastructures, from any attacker. Recent developments have shown that there is more to this endeavor than answering technical questions, particularly since many technical problems do not necessarily seem to have solutions. The...
Read More
Description CVE-2017-7269: Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows Server 2003 R2 allows remote attackers to execute arbitrary code via a long header beginning with “If: <http://” in a PROPFIND request, as exploited in the wild in July or August 2016. Impact: Attackers can exploit this issue to execute arbitrary code in the...
Read More
Description: Race condition in drivers/tty/n_hdlc.c in the Linux kernel through 4.10.1 allows local users to gain privileges or cause a denial of service (double free) by setting the HDLC line discipline. Impact: Local attackers may exploit this issue to gain elevated privileges. Mitigation: Updates are available. Please check the respective vendor advisory for more information. Reference URL’s: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2636 https://access.redhat.com/security/cve/cve-2017-2636 https://security-tracker.debian.org/tracker/CVE-2017-2636 https://kalilinux.co/2017/03/17/cve-2017-2636-linux-kernel-flaw-can-local-privilege-escalation/#.WM-uEmclHIU
Description CVE-2017-3881: Cisco is warning of a new critical IOS / IOS XE vulnerability that affects more than 300 of its switch models. A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a reload of an affected device or remotely execute code with elevated privileges. Impact: An...
Read More
Description: The Jakarta Multipart parser in Apache Struts 2 2.3.x before 2.3.32 and 2.5.x before 2.5.10.1 mishandles file upload, which allows remote attackers to execute arbitrary commands via a #cmd= string in a crafted Content-Type HTTP header, as exploited in the wild in March 2017. Impact: This vulnerability allows for unauthenticated, remote code execution on the server. Mitigation: Upgrade to Struts 2.3.32 or Struts 2.5.10.1...
Read More
Description: Cross-site scripting (XSS) via media file metadata. Control characters can trick redirect URL validation Unintended files can be deleted by administrators using the plugin deletion functionality Cross-site scripting (XSS) via video URL in YouTube embeds. Cross-site scripting (XSS) via taxonomy term names. Cross-site request forgery (CSRF) in Press This leading to excessive use of server resources Impact: Intruder may perform malicious activity by exploiting...
Read More
Description: In Roundcube 1.2.2 and earlier, user-controlled input flows unsanitized into the fifth argument of a call to PHP’s built-in function mail() which is documented as security critical. The problem is that the invocation of the mail() function will cause PHP to execute the sendmail program. The fifth argument allows to pass arguments to this execution which allows a configuration of sendmail. Since sendmail offers...
Read More
