Threat Advisory

Bad Rabbit Ransomeware [CVE-2017-0145]

Vulnerability Overview:

The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0144, CVE-2017-0146, and CVE-2017-0148.

Details:

"Broadpwn" Bug Affects Millions of Android and iOS Devices- Advisory [CVE-2017-9417]

Vulnerability Overview:

Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue.

Details:

Broadpwn bug is actually a heap overflow on Broadcom Wi-Fi chips which is triggered, when a device receives a WME (Quality-of-Service) information element with a malformed length from a connected network. The exploitation does not require any user interaction. A victim needs to connect his/her device to attacker wi-fi signal.

WannaCry Ransomware – Advisory [CVE-2017-0144]

Vulnerability Overview:
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to execute arbitrary code via crafted packets, aka "Windows SMB Remote Code Execution Vulnerability." This vulnerability is different from those described in CVE-2017-0143, CVE-2017-0145, CVE-2017-0146, and CVE-2017-0148. 
 
Details:

Windows SAM and LSAD Downgrade Vulnerability (Badlock) Advisory [CVE-2016-0128]

Vulnerability Overview:

The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attackers to perform protocol-downgrade attacks and impersonate users by modifying the client-server data stream, aka ÔÇ£Windows SAM and LSAD Downgrade VulnerabilityÔÇØ or ÔÇ£BADLOCKÔÇØ.

Details:

Drown Attack [CVE-2016-0800]

Vulnerability Overview:

The SSLv2 protocol, as used in OpenSSL before 1.0.1s and 1.0.2 before 1.0.2g and other products, requires a server to send a ServerVerify message before establishing that a client possesses certain plaintext RSA data, which makes it easier for remote attackers to decrypt TLS ciphertext data by leveraging a Bleichenbacher RSA padding oracle, aka a "DROWN" attack.

Details:

Subscribe to RSS - Threat Advisory