The September Patch Tuesday release from Microsoft included 18 critical fixes and 79 in total. The fixes include several Remote Code Execution vulnerabilities: RDP client-side remote code execution vulnerabilities Four remote code execution vulnerabilities were fixed in the Remote Desktop Services client. If a user can be tricked into connecting to a malicious RDP serverRead more
Blog
Symantec Endpoint Protection for Windows 7 and Server 2008 R2 is blocking Windows updates since August 2019. Back in April 2019 we reported that Microsoft planned to amend the way it digitally signed Windows updates in order to protect against supply chain attacks and ensure only valid, unmodified Microsoft issued patches are installed. This changeRead more
A potential remote code execution vulnerability has been discovered in the popular GPL-licensed FTP server ProFTPD ProFTPD is running on over a million servers exposed to the internet. It is included in several Linux distros including Debian, Suse and Ubuntu. The flaw, tracked under CVE-2019-12815 lives in the mod_copy module. The flaw allows an unauthenticated user toRead more
Microsoft’s July Patch Tuesday updates resolve 77 vulnerabilities in Windows software, including two zero-day vulnerabilities which are being actively exploited and remote code execution vulnerabilities in DHCP Server and MS SQL Server. DHCP Server RCE vulnerability If you have your Microsoft DHCP server configured with a failover server, an attacker can send a specially craftedRead more
Since early May, the city of Baltimore has struggled to recover IT systems following a ransomware attack that has left many departments unable to function or even send and receive emails. Citizens have been unable to complete house sales, pay their water bills or receive health alerts. The RobbinHood malware that has attacked the city’sRead more
The world’s most popular mail server is vulnerable to a remote command execution flaw Exim is the world’s most popular mail server, with 57% of the mail servers connected to the web running Exim (as of June 2019). The vulnerability reported by Qualys (CVE-2019-10149) affects Exim versions 4.87 to 4.91 inclusive running on several LinuxRead more
A team including some of the researchers who discovered the Spectre and Meltdown vulnerabilities in AMD and Intel CPU announced a new class of vulnerability affecting Intel CPU which they called Zombieload. Like Spectre and Meltdown, the Zombieload vulnerability exploits weaknesses in the implementation of speculative execution in Intel CPUs. The different attack names reflectRead more
Microsoft included a fix for a serious RDP remote code execution vulnerability known as BlueKeep in the May patch Tuesday update. The vulnerability, which has become known as BlueKeep or CVE-2019-0708, remains unpatched on millions of internet connected systems. It affects all Windows-NT based operating systems ranging from Windows 2000 and Windows XP up toRead more
Dell SupportAssist software prior to 3.2.0.90 contains two critical remote code execution vulnerabilities. Dell has just released a new version of their SupportAssist software which comes pre-installed on most systems to correct CVE-2019-3719. A 17 year old security researcher discovered a weakness in the way the Dell software validated the identity of the dell.com website. This madeRead more
LightNeuron is a backdoor specifically designed to target Microsoft Exchange mail servers. It permits attackers to read and reroute all email passing through the server and execute commands on the server hidden in incoming email attachments. A recent paper published by ESET describes how the malware functions and the risks it poses. The researcher says:Read more
