Aggregator

A vulnerability was found in code-projects Job Recruitment 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file reset.php. The manipulation of the argument e leads to sql injection. This vulnerability is known as CVE-2024-11241. The attack can be launched remotely. Furthermore, there is an exploit available.

本文使用ZoomEye平台新升级的增强新语法，基于"行为测绘"理念，针对最近一年时间内网络资产测绘数据进行多维度分析，拓展发现LockBit相关基础设施。

A data breach at an unnamed French hospital exposed the medical records of 750,000 patients after a threat actor gained access to its electronic patient record system. [...]

A vulnerability was found in Linux Kernel up to 6.6.50/6.10.9. It has been rated as critical. This issue affects the function peer_nss. The manipulation leads to denial of service. The identification of this vulnerability is CVE-2024-46827. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as critical was found in Linux Kernel up to 6.11.3. Affected by this vulnerability is the function ERR_PTR of the file uvc_v4l2.c. The manipulation leads to null pointer dereference. This vulnerability is known as CVE-2024-50056. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.56/6.11.3. It has been declared as problematic. Affected by this vulnerability is the function __get_name of the component ntfs3. The manipulation leads to allocation of resources. This vulnerability is known as CVE-2024-50065. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Cisco Identity Services Engine Software. Affected by this vulnerability is an unknown functionality of the component Web-based Management Interface. The manipulation leads to cross site scripting. This vulnerability is known as CVE-2024-20525. The attack can be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Cisco Identity Services Engine Software. This affects an unknown part of the component Web-based Management Interface. The manipulation leads to cross site scripting. This vulnerability is uniquely identified as CVE-2024-20530. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Google Android. It has been declared as problematic. Affected by this vulnerability is the function DevmemIntChangeSparse of the file devicemem_server.c. The manipulation leads to enforcement of behavioral workflow. This vulnerability is known as CVE-2023-35659. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Google Android. It has been rated as problematic. Affected by this issue is the function PVRSRVRGXKickTA3DKM of the file rgxta3d.c. The manipulation leads to improper input validation. This vulnerability is handled as CVE-2023-35686. The attack needs to be approached locally. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability classified as critical was found in Google Android. This vulnerability affects the function PMRWritePMPageList of the file pmr.c. The manipulation leads to out-of-bounds write. This vulnerability was named CVE-2024-23715. Local access is required to approach this attack. There is no exploit available. It is recommended to apply a patch to fix this issue.

A vulnerability was found in Linux Kernel up to 6.1.112/6.6.56/6.11.3 and classified as problematic. This issue affects some unknown processing of the component io_uring. The manipulation leads to state issue. The identification of this vulnerability is CVE-2024-50060. The attack needs to be approached within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.1.109/6.6.50/6.10.9. It has been declared as problematic. This vulnerability affects the function kernel.randomize_va_space. The manipulation leads to insufficiently random values. This vulnerability was named CVE-2024-46826. Access to the local network is required for this attack. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.10.8. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component AMD Display. The manipulation of the argument amdgpu_dm leads to improper initialization. This vulnerability is known as CVE-2024-46816. The attack needs to be done within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.10.8. It has been rated as problematic. Affected by this issue is some unknown functionality of the component AMD Display. The manipulation of the argument amdgpu_dm leads to improper initialization. This vulnerability is handled as CVE-2024-46817. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in Linux Kernel up to 6.10.8. This vulnerability affects the function amdgpu_irq_put of the component AMD Display. The manipulation leads to state issue. This vulnerability was named CVE-2024-46820. Access to the local network is required for this attack to succeed. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.50/6.10.9. It has been classified as problematic. This affects the function iwl_mvm_rcu_fw_link_id_to_link_conf of the component iwlwifi. The manipulation leads to Privilege Escalation. This vulnerability is uniquely identified as CVE-2024-46825. The attack needs to be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.

作者：知道创宇404实验室 日期：2024年11月21日 English version: https://paper.seebug.org/3239/ 一．摘要 LockBit 3.0 是一种知名的勒索软件，由网络犯罪组织通过“勒索软件即服务”（RaaS）模式运作。LockBit 3.0勒索软件联盟是使用该恶意软件进行攻击的独立黑客，他们以分成方式合作。这些成员利用 LockBit 提供的...

研究人员发现，黑客可以通过利用近场通信 (NFC) 大规模套现受害者资金的新技术。  地下论坛上的一篇帖子 该技术由 ThreatFabric 命名为Ghost Tap，可让网络犯罪分子从与 Google Pay 或 Apple Pay 等移动支付服务关联并中继 NFC 流量的被盗信用卡中套现资金。 这家荷兰安全公司称：“犯罪分子现在可以滥用 Google Pay 和 Apple Pay，在几秒钟内将您的点击支付信息传输到全球。”“这意味着即使没有您的实体卡或手机，他们也可以在世界任何地方通过您的账户付款。” 这些攻击通常通过诱骗受害者下载手机银行恶意软件来实施，恶意软件可以使用覆盖攻击或键盘记录器来获取受害者的银行凭证和一次性密码。或者，它可能涉及语音钓鱼组件。 一旦掌握了信用卡详细信息，攻击者就会将信用卡与 Google Pay 或 Apple Pay 关联起来。但为了避免发卡机构封锁信用卡，点击支付信息会被转发给若干名“钱骡”（黑色产业链中负责洗钱或提取现金的人），后者负责在商店进行欺诈性购买。 这是通过一种名为NFCGate的合法研究工具实现的，它可以捕获、分析或修改 NFC 流量。它还可用于通过服务器在两个设备之间传递 NFC 流量。 NFCGate开源项目作者德国达姆施塔特工业大学安全移动网络实验室的研究人员表示：“一台设备作为‘读取器’读取 NFC 标签，另一台设备使用主机卡模拟 (HCE) 模拟 NFC 标签。” 尽管 NFCGate 之前曾被不良行为者使用，将 NFC 信息从受害者的设备传输给攻击者，正如ESET 早在 2024 年 8 月使用 NGate 恶意软件所记录的那样，但最新的进展标志着该工具首次被滥用来传递数据。 ThreatFabric 指出：“网络犯罪分子可以在装有被盗卡的设备和零售商的 PoS [销售点] 终端之间建立中继，保持匿名并进行更大规模的套现。” “持有被盗卡的网络犯罪分子可能远离使用该卡的地点（甚至是不同的国家），也可能在短时间内在多个地点使用同一张卡。” 这种策略的优势在于，它可以用来在线下零售商处购买礼品卡，而网络犯罪分子无需亲自到场。更糟糕的是，它可以被用来在短时间内招募不同地点的多名钱骡，从而扩大欺诈计划的规模。 Ghost Tap攻击的检测难度在于，交易看起来好像来自同一台设备，从而绕过了反欺诈机制。连接卡的设备也可能处于飞行模式，这会使检测其实际位置变得困难，并且很难发现它实际上并未用于在 PoS 终端进行交易。 ThreatFabric 指出：“我们怀疑，随着网络的不断发展，通信速度越来越快，再加上 ATM/POS 终端缺乏适当的基于时间的检测，使得这些攻击成为可能，因为带有卡的实际设备物理上远离进行交易的地点（设备不在 PoS 或 ATM 上）。” “由于能够迅速扩大规模并在匿名的掩护下运作，这种套现方式对金融机构和零售机构都构成了重大挑战。”     转自军哥网络安全读报，原文链接：https://mp.weixin.qq.com/s/334uX_p2THzcfpBuTMjkyA 封面来源于网络，如有侵权请联系删除

Ubuntu Server（自 21.04 版起）默认安装的 needrestart 包中被发现存在多个已有十年历史的安全漏洞，这些漏洞可能允许本地攻击者在无需用户交互的情况下获得 root 权限。 Qualys 威胁研究部门 (TRU)于上个月初发现并报告了这些漏洞，并表示这些漏洞很容易被利用，因此用户必须迅速采取行动来修复。 据信这些漏洞自 2014 年 4 月 27 日发布的needrestart 0.8引入解释器支持以来就一直存在。 Ubuntu 在一份公告中表示：“这些 needrestart 漏洞允许本地特权升级 (LPE)，这意味着本地攻击者能够获得 root 权限” ，并指出这些问题已在 3.8 版中得到解决。“这些漏洞影响 Debian、Ubuntu 和其他 Linux 发行版。” Needrestart 是一个实用程序，它可以扫描系统以确定在应用共享库更新后需要重新启动的服务，以避免整个系统重新启动。 具体来说，如果服务正在使用过时的共享库（例如在软件包更新期间替换库），它会标记服务以进行重新启动。 由于它集成到服务器映像中，因此 needrestart 设置为在 APT 操作（如安装、升级或删除，包括无人值守升级）后自动运行。其主要作用是识别在关键库更新后需要重新启动的服务，例如 C 库 (glibc)。此过程可确保服务使用最新的库版本，而无需完全重启系统，从而提高正常运行时间和性能。 通过使用最新的库及时更新服务，needrestart 对于维护 Ubuntu Server 的安全性和效率至关重要。 Qualys 威胁研究部门发现的5个漏洞： CVE-2024-48990（CVSS 评分：7.8） – 该漏洞允许本地攻击者通过诱骗 needrestart 使用攻击者控制的 PYTHONPATH 环境变量运行 Python     解释器，从而以 root 身份执行任意代码 CVE-2024-48991（CVSS 评分：7.8） – 该漏洞允许本地攻击者通过赢得竞争条件并诱骗 needrestart 运行自己的伪 Python 解释器，以 root     身份执行任意代码 CVE-2024-48992（CVSS 评分：7.8） – 该漏洞允许本地攻击者通过诱骗 needrestart 使用攻击者控制的 RUBYLIB 环境变量运行 Ruby 解释器，从而以     root 身份执行任意代码 CVE-2024-11003（CVSS 评分：7.8）和CVE-2024-10224（CVSS 评分：5.3）- 这两个漏洞允许本地攻击者利用libmodule-scandeps-perl 软件包（版本 1.36 之前）中的问题以 root 身份执行任意 shell 命令 成功利用上述缺陷可以允许本地攻击者为 PYTHONPATH 或 RUBYLIB 设置特 制的环境变量，从而导致在运行 needrestart 时执行指向攻击者环境的任意代码。 Ubuntu 指出：“在 CVE-2024-10224 中，[…] 攻击者控制的输入可能导致 Module::ScanDeps Perl 模块通过 open() 一个‘讨厌的管道’（例如通过传递‘commands|’作为文件名）或通过将任意字符串传递给 eval() 来运行任意 shell 命令。” “就其本身而言，这不足以实现本地权限提升。然而，在 CVE-2024-11003 中，needrestart 将攻击者控制的输入（文件名）传递给 Module::ScanDeps，并以 root 权限触发CVE-2024-10224。CVE-2024-11003 的修复消除了 needrestart 对 Module::ScanDeps 的依赖。” 虽然强烈建议用户下载最新的补丁，Ubuntu 表示用户可以根据需要禁用解释器扫描器，重新启动配置文件作为临时缓解措施，并确保在应用更新后恢复更改。 Qualys 公司 TRU 产品经理 Saeed Abbasi 表示：“needrestart 实用程序中的这些漏洞允许本地用户通过在软件包安装或升级期间执行任意代码来提升其权限，其中 needrestart 通常以 root 用户身份运行。” “利用这些漏洞的攻击者可以获得 root 访问权限，从而损害系统完整性和安全性。” 参考漏洞公告: https://blog.qualys.com/vulnerabilities-threat-research/2024/11/19/qualys-tru-uncovers-five-local-privilege-escalation-vulnerabilities-in-needrestart https://ubuntu.com/blog/needrestart-local-privilege-escalation       转自军哥网络安全读报，原文链接：https://mp.weixin.qq.com/s/VzdXqbGwPXAfqoXZi_9mxA 封面来源于网络，如有侵权请联系删除