by CIRT Team
Multiple Vulnerabilities in Apache Web Server Could Allow for Remote Code Execution
DESCRIPTION Apache web server is a common application used as a web application server. Being a open source software, it is extremely common and used throughout almost all the organizations. A specially crafted packet can crash the service and user can gain access and perform Remote Code Execution (RCE) on the server. If the attacker can perform the attack successfully, depending on the access level...
Read More
by CIRT Team
Microsoft Windows – ‘SMBGhost’ Remote Code Execution (CVE-2020-0796)
DESCRIPTION Server Message Block (SMB) is a protocol which is commonly found in windows based systems. This is a common method for sharing folder and accessing them via network. This method is quite common which makes this vulnerability very dangerous as even large enterprises usually have common shared location where they can store and retrieve files. IMPACTThis vulnerability can lead towards development of many malware...
Read More
by CIRT Team
Netgear httpd upgrade_check.cgi stack buffer overflow
DESCRIPTION Almost all of the Netgear devices now contains web interface for easy management. It becomes easy for the home administrator to configure and manage the device efficiently. Moreover, WiFi routers from this company is widely used Bangladesh. To do this httpd service has been used and it fails to validate the he header size provided to the upgrade_check.cgi handler. Despite copying the header to...
Read More
by CIRT Team
Multiple Vulnerabilities in SAP Products Could Allow for Arbitrary Code Execution
DESCRIPTIONMultiple vulnerabilities have been discovered in SAP products, the most severe of which could allow an unauthenticated, remote attacker to execute code on the affected systems. Details of the vulnerabilities are as follows: * Multiple Vulnerabilities in SAP NetWeaver AS JAVA (LM Configuration Wizard) (CVE-2020-6286).* Security updates for the browser control Google Chromium delivered with SAP Business Client.* Information Disclosure in SAP NetWeaver (XMLToolkit for...
Read More
by CIRT Team
TMUI RCE vulnerability CVE-2020-5902
Description In BIG-IP versions 15.0.0-15.1.0.3, 14.1.0-14.1.2.5, 13.1.0-13.1.3.3, 12.1.0-12.1.5.1, and 11.6.1-11.6.5.1, the Traffic Management User Interface (TMUI), also referred to as the Configuration utility, has a Remote Code Execution (RCE) vulnerability in undisclosed pages. Impact This vulnerability allows for unauthenticated attackers, or authenticated users, with network access to the TMUI, through the BIG-IP management port and/or Self IPs, to execute arbitrary system commands, create or delete...
Read More
by CIRT Team
Common Vulnerabilities and Exposures (CVE) Report June 2020
The Common Vulnerabilities and Exposures (CVE) system provides a reference-method for publicly known information-security vulnerabilities and exposures. The National Cybersecurity FFRDC, operated by the Mitre Corporation, maintains the system, with funding from the National Cyber Security Division of the United States Department of Homeland Security. Report : Following is the CVE report from BGD e-GOV CIRT for the month of June 2020.
by CIRT Team
SaltStack Patches Critical Vulnerabilities in Salt
SaltStack has released a security update to address critical vulnerabilities affecting Salt versions prior to 2019.2.4 and 3000.2. Salt is an open-source remote task and configuration management framework widely used in data centers and cloud servers. A remote attacker could exploit these vulnerabilities to take control of an affected system. These vulnerabilities were detected in exploits in the wild. CVE-2020-11651: An issue was discovered in...
Read More
by CIRT Team
ISC Releases Security Advisories for BIND
CVE-2020-8618:An assertion check in BIND (that is meant to prevent going beyond the end of a buffer when processing incoming data) can be incorrectly triggered by a large response during zone transfer. Impact: An attacker who is permitted to send zone data to a server via zone transfer can exploit this to intentionally trigger the assertion failure with a specially constructed zone, denying service to...
Read More
by CIRT Team
Drupal Releases Security Updates
Drupal has released security updates to address vulnerabilities affecting Drupal 7, 8.8, 8.9, and 9.0. A remote attacker could exploit one of these vulnerabilities to take control of an affected system. For more information, please visit following URL:https://www.drupal.org/sa-core-2020-004https://www.drupal.org/sa-core-2020-005
by CIRT Team
WordPress Releases Security and Maintenance Update
WordPress 5.4.1 and prior versions are affected by multiple vulnerabilities. An attacker could exploit some of these vulnerabilities to take control of an affected website. WordPress 5.4.2 is now available. For more information, please visit following URL:https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
