Aggregator

记录从蓝队小白到蓝队中级的面试题以及面试经验 #心路历程

Op dit moment zijn er problemen met IT-netwerken bij Defensie. De oorzaak is nog niet bekend. Medewerkers ondervinden inlog-problemen en in enkele gevallen is er impact op dienstverlening doordat telefoonnummers niet bereikbaar zijn. Er wordt gewerkt aan een oplossing.

Как боты-невидимки обманывают CAPTCHA?

SafeBreach 安全研究员 Alon Leviev 发布了其Windows Downdate工具，该工具可用于Windows降级攻击，重新引入最新的 Windows 10、Windows 11 和 Windows Server 系统中的旧漏洞。 在这种攻击中，攻击者强迫最新的目标设备恢复到旧软件版本，从而重新引入可被利用来破坏系统的安全漏洞。 Windows Downdate 是一个基于 Python 的开源程序和预编译的 Windows 可执行文件，可以帮助降级 Windows 10、Windows 11 和 Windows Server 系统组件。 Leviev 分享了多个使用示例，允许将 Hyper-V 虚拟机管理程序降级至两年前的版本、Windows 内核、NTFS 驱动程序和过滤器管理器驱动程序（降级至其基本版本）以及其他 Windows 组件和以前应用的安全补丁。 SafeBreach 安全研究员 Alon Leviev解释说：“您可以使用它来接管 Windows 更新，以降级并暴露 DLL、驱动程序、NT 内核、安全内核、虚拟机管理程序、IUM 信任程序等中的过去漏洞。除了自定义降级之外，Windows Downdate 还提供了易于使用的恢复 CVE-2021-27090、CVE-2022-34709、CVE-2023-21768 和 PPLFault 补丁的使用示例，以及降级虚拟机管理程序、内核和绕过 VBS 的 UEFI 锁的示例。” 正如 Leviev 在 Black Hat 2024 上披露 Windows Downdate 降级攻击（利用CVE-2024-21302和CVE-2024-38202漏洞）时所说的那样，使用此工具是无法检测到的，因为它无法被端点检测和响应 (EDR) 解决方案阻止，并且 Windows 更新会不断报告目标系统是最新的（尽管已被降级）。 “我发现了多种禁用 Windows 基于虚拟化的安全性 (VBS) 的方法，包括其 Credential Guard 和 Hypervisor 保护的代码完整性 (HVCI) 等功能，即使在使用 UEFI 锁强制执行的情况下也是如此。据我所知，这是第一次在没有物理访问的情况下绕过 VBS 的 UEFI 锁。” Leviev 说。“结果，我能够让一台完全修补过的 Windows 机器受到过去数千个漏洞的攻击，将已修复的漏洞变成零日漏洞，并让世界上任何一台 Windows 机器上的‘完全修补’一词变得毫无意义。” 尽管微软于 8 月 7 日发布了安全更新 ( KB5041773 ) 来修复 CVE-2024-21302 Windows 安全内核模式权限提升漏洞，但该公司尚未针对 Windows 更新堆栈权限提升漏洞 CVE-2024-38202 提供补丁。 在安全更新发布之前，微软建议客户实施本月早些时候发布的安全公告中分享的建议，以帮助防止 Windows Downdate 降级攻击。 该问题的缓解措施包括配置“审计对象访问”设置来监控文件访问尝试、限制更新和恢复操作、使用访问控制列表来限制文件访问以及审计权限来识别利用此漏洞的尝试。   转自军哥网络安全读报，原文链接：https://mp.weixin.qq.com/s/va31Jea1GBsHGhhqIW3vcg 封面来源于网络，如有侵权请联系删除

  Applications are typically tested and guaranteed to function on specific Linux distributions, but may work on others as well. Kernel versions, libraries, and system calls are key factors affecting binary compatibility between distributions. Differences in the operating system’s ABI (Application Binary Interface) are also a frequent source of compatibility problems. Binary compatibility is an […]

The post What is binary compatibility, and what does it mean for Linux distributions? appeared first on TuxCare.

The post What is binary compatibility, and what does it mean for Linux distributions? appeared first on Security Boulevard.

非常好的综述

A vulnerability, which was classified as problematic, has been found in OpenText NetIQ Access Manager up to 5.0.4.0. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. This vulnerability is handled as CVE-2024-4554. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic was found in OpenText NetIQ Advance Authentication up to 6.3.5.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to information disclosure. This vulnerability is known as CVE-2021-22529. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in OpenText NetIQ Advance Authentication up to 6.3.5.0. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is traded as CVE-2021-38122. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Xiaomi XiaomiGetApps Application up to 30.2.7.0. It has been rated as very critical. This issue affects some unknown processing. The manipulation leads to code injection. The identification of this vulnerability is CVE-2024-45346. The attack may be initiated remotely. There is no exploit available.

A vulnerability was found in OpenText NetIQ Access Manager up to 5.0.4.0. It has been declared as critical. This vulnerability affects unknown code. The manipulation leads to improper privilege management. This vulnerability was named CVE-2024-4555. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenText NetIQ Advance Authentication up to 6.3.5.0. It has been classified as problematic. This affects an unknown part of the component TLS Protocol Handler. The manipulation leads to inadequate encryption strength. This vulnerability is uniquely identified as CVE-2021-38121. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in OpenText NetIQ Advance Authentication up to 6.3.5.0 and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to command injection. This vulnerability is handled as CVE-2021-38120. The attack needs to be approached locally. There is no exploit available. It is recommended to upgrade the affected component.

漏洞及其有效利用每个季度都在继续增长，威胁行为者正在寻找让已修补漏洞复活的方法。利用这种漏洞的主要技巧之一是BYOVD技术。

A vulnerability has been found in OpenText NetIQ Advance Authentication up to 6.3.5.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cleartext storage of sensitive information. This vulnerability is known as CVE-2021-22509. It is possible to launch the attack on the local host. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in Safie QBiC CLOUD CC-2L and One. Affected is an unknown function. The manipulation leads to improper certificate validation. This vulnerability is traded as CVE-2024-39771. It is possible to launch the attack remotely. There is no exploit available.

A vulnerability, which was classified as very critical, has been found in Xiaomi GetApps Application up to 30.6.0.2. This issue affects some unknown processing. The manipulation leads to code injection. The identification of this vulnerability is CVE-2023-26324. The attack may be initiated remotely. There is no exploit available.

A vulnerability classified as critical was found in OpenText NetIQ Advance Authentication up to 6.3.5.0. This vulnerability affects unknown code of the component API Login. The manipulation leads to improper locking. This vulnerability was named CVE-2021-22530. The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability classified as problematic has been found in OpenText NetIQ Access Manager up to 5.0.3. This affects an unknown part. The manipulation leads to path traversal. This vulnerability is uniquely identified as CVE-2024-4556. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Linux Kernel up to 6.6.46. It has been rated as problematic. Affected by this issue is the function try_grab_folio of the file mm/gup.c. The manipulation leads to improper update of reference count. This vulnerability is handled as CVE-2024-44943. The attack can only be initiated within the local network. There is no exploit available. It is recommended to upgrade the affected component.