Security Leftovers
-
High-Severity Squid Vulnerabilities Fixed in Ubuntu
Squid is a powerful tool for caching proxy for the web, but like any software, it is not immune to vulnerabilities. Several security vulnerabilities have been discovered that could potentially lead to a denial of service. So, if you’re using Squid, it’s essential to understand the nature of these vulnerabilities and take appropriate actions to mitigate any potential risks.
-
InfoSecurity Magazine ☛ Linux Malware Campaign “Migo” Targets Redis For Cryptomining [Ed: Redis is not Linux, just like Photoshop is not Windows]
Security researchers have uncovered a sophisticated malware campaign targeting Redis, a popular data store system. This campaign, dubbed “Migo,” employs novel tactics to compromise Redis servers, with the ultimate goal of mining cryptocurrency on Linux hosts.
-
Cybernews ☛ Best free VPN for Linux in 2024 [Ed: Based on the links, this is spam disguised as "information"]
-
IT News AU ☛ Privacy Watchdog to investigate HWL Ebsworth over security and notifications
The investigation will cover whether the law firm violated the Privacy Act by failing to protect sensitive data or properly notifying individuals affected by the breach.
The breach saw 1.1TB of data lost to hackers and impacted 65 government agency clients’ data as well as data belonging to private firms as well.
The Office of the Australian Information Commissioner (OAIC) made “preliminary inquiries” at the time of the breach last year, but said there was now a need to open a formal investigation into the law firm’s “personal information handling practices”.
-
Integrity/Availability/Authenticity
-
Trail of Bits ☛ Breaking the shared key in threshold signature schemes
Today we are disclosing a denial-of-service vulnerability that affects the Pedersen distributed key generation (DKG) phase of a number of threshold signature scheme implementations based on the Frost, DMZ21, GG20, and GG18 protocols. The vulnerability allows a single malicious participant to surreptitiously raise the threshold required to reconstruct the shared key, which could cause signatures generated using the shared key to be invalid.
-
-
Windows TCO
-
Cyble Inc ☛ VMware Issues Warning On CVE-2024-22245 And CVE-2024-22250
In a recent security advisory, VMware has urgently recommended the removal of the enhanced authentication plug-in (EAP) due to the discovery of critical vulnerabilities named CVE-2024-22245 and CVE-2024-22250.
The deprecated EAP, which provided Windows authentication and Windows-based smart card support for VSphere, has been identified as carrying two vulnerabilities, one of which is deemed critical.
-