Description: An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name for the zone and service being targeted may be able to manipulate BIND into accepting an unauthorized dynamic update. Impact: A server that relies solely on TSIG keys with no other address-based ACL protection could be vulnerable to malicious...
Read More
Description: An attacker who is able to send and receive messages to an authoritative DNS server and who has knowledge of a valid TSIG key name may be able to circumvent TSIG authentication of AXFR requests via a carefully constructed request packet. A server that relies solely on TSIG keys for protection with no other ACL protection could be manipulated into: providing an AXFR of...
Read More
Description: Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in memory, aka “Office Remote Code Execution Vulnerability”. This CVE ID is unique from CVE-2017-0262 and CVE-2017-0281. Impact: An attacker can leverage this issue to execute arbitrary code in the context of the affected application. Failed exploit attempts will likely...
Read More
Description: The flaw was discovered last month by security researchers from Qualys, who worked with various vendors to make sure patches are available before going public with their findings. According to Qualys researchers, the issue affects a host of *NIX systems, such as Linux, OpenBSD, NetBSD, FreeBSD, and Solaris. Researchers only tested Stack Clash on the i386 and amd64 platforms, and they don’t exclude that...
Read More
Description: In Wireshark 2.2.0 to 2.2.6, the ROS dissector could crash with a NULL pointer dereference. This was addressed in epan/dissectors/asn1/ros/packet-ros-template.c by validating an OID. Impact: Attackers can exploit this issue to crash the affected application, resulting in denial-of-service conditions. Mitigation: Upgrade to Wireshark 2.2.7 or later. Reference URL’s: http://www.securityfocus.com/bid/98800/info http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9347 https://www.wireshark.org/security/wnpa-sec-2017-31.html
