#openssl Privilege Escalation

[systemtek]

3CX Uncontrolled Search Path Local Privilege Escalation Vulnerability [CVE-2023-27362]

CVE number = CVE-2023-27362 This vulnerability allows local attackers to escalate privileges on affected installations of 3CX. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. 3CX has issued an update to correct this vulnerability. More details can be found at:https://www.3cx.com/blog/releases/v18-u8/ Read the full article

[orbitbrain]

Cisco Patches High-Severity Bugs in Email, Identity, Web Security Products

Cisco Patches High-Severity Bugs in Email, Identity, Web Security Products

Home › Vulnerabilities Cisco Patches High-Severity Bugs in Email, Identity, Web Security Products By Ionut Arghire on November 03, 2022 Tweet Cisco this week announced the release of patches for multiple vulnerabilities across its product portfolio, including high-severity defects in identity, email, and web security products. The most severe of these issues is CVE-2022-20961 (CVSS score of 8.8),…

[topiafree]

Sades 7.1 does not support this platform

Fixed bug #81252 (PDO_ODBC doesn't account for SQL_NO_TOTAL).Fixed bug #81327 (Error build openssl extension on php 7.4.22).Fixed bug #74544 (Integer overflow in mysqli_real_escape_string()).Fixed bug #51498 (imagefilledellipse does not work for large circles).Fixed bug #80849 (HTTP Status header truncation).Fixed bug #81305 (Built-in Webserver Drops Requests With "Upgrade" Header).Fixed bug #66719 (Weird behaviour when using get_called_class() with call_user_func()).Fixed bug #72595 (php_output_handler_append illegal write access).Fixed bug #81420 (ZipArchive::extractTo extracts outside of destination).Fixed bug #81351 (xml_parse may fail, but has no error code).Fixed bug #78819 (Heap Overflow in msg_send).Fixed bug #81400 (Unterminated string in dns_get_record() results).Fixed bug #71542 (disk_total_space does not work with relative paths).Fixed bug #81407 (shmop_open won't attach and causes php to crash).Fixed bug #81353 (segfault with preloading and statically bound closure).Fixed bug #53580 (During resize gdImageCopyResampled cause colors change).Fixed bug #73122 (Integer Overflow when concatenating strings).Fixed bug #81346 (Non-seekable streams don't update position after write).Fixed bug #81302 (Stream position after stream filter removed).Fixed bug #77978 (Dirname ending in colon unzips to wrong dir).Fixed bug #81490 (ZipArchive::extractTo() may leak memory).Fixed bug #70962 (XML_OPTION_SKIP_WHITE strips embedded whitespace).Fixed bug #81475 (stream_isatty emits warning with attached stream wrapper).Fixed bug #80663 (Recursive SplFixedArray::setSize() may cause double-free).Fixed bug #81026 (PHP-FPM oob R/W in root process leading to privilege escalation) (CVE-2021-21703).Fixed bug #61700 (FILTER_FLAG_IPV6/FILTER_FLAG_NO_PRIV|RES_RANGE failing).

Fixed bug #78987 (High memory usage during encoding detection).

Fixed bug #79576 ("TYPE *" shows unhelpful message when type is not defined).

Fixed bug #81433 (DOMElement::setIdAttribute() called twice may remove ID).

Fixed bug #79971 (special character is breaking the path in xml function).

Fixed bug #54340 (Memory corruption with user_filter).

Fixed bug #81424 (PCRE2 10.35 JIT performance regression).

Fixed bug #81494 (Stopped unbuffered query does not throw error).

Fixed bug #76167 (mbstring may use pointer from some previous request).

Fixed bug #81500 (Interval serialization regression since 7.3.14 / 7.4.2).

Fixed bug #81518 (Header injection via default_mimetype / default_charset).

Getting Started Introduction A simple tutorial Language Reference Basic syntax Types Variables Constants Expressions Operators Control Structures Functions Classes and Objects Namespaces Enumerations Errors Exceptions Generators Attributes References Explained Predefined Variables Predefined Exceptions Predefined Interfaces and Classes Context options and parameters Supported Protocols and Wrappers Security Introduction General considerations Installed as CGI binary Installed as an Apache module Session Security Filesystem Security Database Security Error Reporting User Submitted Data Hiding PHP Keeping Current Features HTTP authentication with PHP Cookies Sessions Dealing with XForms Handling file uploads Using remote files Connection handling Persistent Database Connections Command line usage Garbage Collection DTrace Dynamic Tracing Function Reference Affecting PHP's Behaviour Audio Formats Manipulation Authentication Services Command Line Specific Extensions Compression and Archive Extensions Cryptography Extensions Database Extensions Date and Time Related Extensions File System Related Extensions Human Language and Character Encoding Support Image Processing and Generation Mail Related Extensions Mathematical Extensions Non-Text MIME Output Process Control Extensions Other Basic Extensions Other Services Search Engine Extensions Server Specific Extensions Session Extensions Text Processing Variable and Type Related Extensions Web Services Windows Only Extensions XML Manipulation GUI Extensions Keyboard Shortcuts ? This help j Next menu item k Previous menu item g p Previous man page g n Next man page G Scroll to bottom g g Scroll to top g h Goto homepage g s Goto search

[theobsanmaskalo]

WEEK 8 

Acronis Patches Privilege Escalation Flaws in Backup, Security Solutions

Acronis has released patches for its True Image, Cyber Backup, and Cyber Protect products to address vulnerabilities that could lead to elevation of privileges.

The flaws could allow unprivileged Windows users to run code with SYSTEM privileges, a vulnerability note from the CERT Coordination Center (CERT/CC) reveals.

Tracked as CVE-2020-10138 (CVSS score 8.1), the first of the bugs affects Acronis Cyber Backup 12.5 and Cyber Protect 15 and resides in a privileged service that uses “an OpenSSL component that specifies an OPENSSLDIR variable as a subdirectory within C:\jenkins_agent\.”

Given that unprivileged Windows users are able to create subdirectories off of the system root, it is possible for a user to create the appropriate path to an openssl.cnf file that would allow them to run arbitrary code with SYSTEM privileges.

The second flaw, CVE-2020-10139 (CVSS score 8.1), was found in Acronis True Image 2021 and is similar to CVE-2020-10138: an unprivileged user can abuse the privileged service to execute a specially-crafted openssl.cnf file with SYSTEM privileges.

Identified in Acronis True Image 2021 and tracked as CVE-2020-10140 (CVSS score 8.7), the third vulnerability exists because the backup software fails to properly set access control lists (ACLs) for the C:\ProgramData\Acronis directory.

Thus, an unprivileged user could place a DLL in one of the multiple paths within that directory and achieve arbitrary code execution through privileged processes that are executed from C:\ProgramData\Acronis, the CERT/CC note reveals.

“By placing a specially-crafted openssl.cnf or DLL file in a specific location, an unprivileged user may be able to execute arbitrary code with SYSTEM privileges on a Windows system with the vulnerable Acronis software installed. See DLL Search Order Hijacking for more details,” CERT/CC explains.

Acronis True Image 2021 build 32010, Acronis Cyber Backup 12.5 build 16363, and Acronis Cyber Protect 15 build 24600 were released in early October 2020 with patches for these vulnerabilities.

[coolfilesnetworkm48-blog]

DOWNLOAD SONY ERICSSON D750I DRIVER

File Size: 23 Mb File Format: exe Downloads: 5094 Uploader: Oreo Price: Free Operating Systems: Windows NT/2000/XP/2003/2003/7/8/10 MacOS 10/X Date Added: 25 October, 2019 File Name: sony ericsson d750i driver Download Type: http File Version: 317121651

Bug fix: - CheckSum: 2D2Ah# Fixed onboard codec can't be Enabled/Disabled. - Creating(sony ericsson d750i driver Creating) two or three display portrait Eyefinity groups in Radeon Settings "quick setup" and then clicking "arranging displays" may cause an error. - Fixes and improvements:1. - Fixed Multi package channel description issue. - Fixed summary(sony ericsson d750i driver summary) page "CPU ID/ucode ID" string will show "CPU ID/uc" instead. - Fixes hang-up of OS(sony ericsson d750i driver OS) if PS2 mouse with scroll wheel and USB keyboard installed at the same time. - LAN port 8 Fixed NTP daylight saving issue in AU 9 Fixed issue whereby configuration might not be correct after system reboot. - Fixes Boot Order variable fail When Plug in too many storage. - Fixed a(sony ericsson d750i driver a) bug where a replication error occurs when disconnecting and reconnecting the USB drive after replication task was created. - Fixed the(sony ericsson d750i driver the) following Security Vulnerabilities: - HNAP Privilege Escalation - Command Injection Enhancements:1. Users content: CSCum34719)- Upgrade openssl version. Crosshair Release BIOS version 02031. Hybrid Booster:- CPU Multiplier- CPU Vcore adjustment- CPU Frequency Stepless Control- AGP/PCI frequency fix- ASRock U-COP- Boot Failure Guard (B. Browse to the folder where you extracted the driver and click Ok Type C:\DELL\DRIVERS\R170524 in the Open textbox and then click OK. Firmware Update Instructions:- This firmware update should only be used if your printer's control panel displays a Recovery Mode error. Modify the DMI data to fix on line diagnostic tool issue (PCI Pitstop). SMS commands/notifications now include VPN IP address. Notice for uninstallation>- No uninstaller for the XPS printer drivers. Support FQDN for L2TP/PPTP server address, supporting up to 32 characters. Click to find the DOWNLOAD EPSON C44 PLUS XP DRIVER. Supported OS: Windows 7 64-bit Microsoft Windows 8.1 Pro (64-bit) Microsoft Windows 8.1 Pro (32-bit) Windows Vista 64-bit Windows 7 Windows Server 2012 Microsoft Windows 8.1 Enterprise (32-bit) Windows XP 32-bit Windows Server 2008 Windows 7 32-bit Windows Server 2016 Microsoft Windows 8 (64-bit) Windows Server 2003 64-bit Windows 8 Windows Server 2003 32-bit Windows 2000 Microsoft Windows 8 (32-bit) Microsoft Windows 8 Enterprise (32-bit) Microsoft Windows 8.1 (64-bit) Microsoft Windows 8 Pro (64-bit) Windows Vista 32-bit Microsoft Windows 8 Enterprise (64-bit) Microsoft Windows 8 Pro (32-bit) Microsoft Windows 8.1 Enterprise (64-bit) Windows XP 64-bit Windows 10 Windows Server 2008 R2 Microsoft Windows 10 (32-bit) Windows 8.1/8/7/Vista 32-bit Windows 8.1/8/7/Vista 64-bit Windows Server 2012 R2 Windows 8.1 Microsoft Windows 10 (64-bit) Notebook 8.1/8/7 64-bit Notebook 8.1/8/7 32-bit Microsoft Windows 8.1 (32-bit) Searches: sony ericsson d750i driver for Windows Server 2012; sony ericsson d750i MG7429; sony ericsson d750i driver for Microsoft Windows 8 Enterprise (32-bit); sony ericsson d750i M74p; sony ericsson d750i driver for Windows 8.1/8/7/Vista 64-bit; sony ericsson d750i M MG742-7; sony ericsson d750i driver for Microsoft Windows 8.1 (32-bit); sony ericsson d750i driver for Microsoft Windows 8.1 Pro (32-bit); sony ericsson d750i MGKLT7429; driver d750i ericsson sony; sony ericsson d750i Mpj742-pju Compatible Devices: Ipad; Gadget; Hardware; Video Projector; Usb Cables; Memory Card To ensure the integrity of your download, please verify the checksum value. MD5: 8f453ecfbda703ce49d7d2e3f287a24c SHA1: e13acb7173ca5c7a1ddf39c2c9f4e922c23f5d3f SHA-256: 82b74d6492e091170f78f750803ea74b78201694f478e2263d6c8e0b91bb1835

[ossig]

Finished Reading: Day 44: Linux Capabilities Privilege Escalation via OpenSSL with SELinux Enabled and Enforced

https://ift.tt/368HYSC via Read it Later (May 03, 2019 at 11:16AM )

[systemtek]

McAfee Safe Connect VPN Uncontrolled Search Path Element Local Privilege Escalation Vulnerability [CVE-2023-40352]

CVE number = CVE-2023-40352 Affected product = McAfee Safe Connect VPN This vulnerability allows local attackers to escalate privileges on affected installations of McAfee Safe Connect VPN. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. McAfee has issued an update to correct this vulnerability. More information can be found at:https://www.mcafee.com/support/?articleId=TS103462&page=shell&shell=article-view Read the full article