news
Security Leftovers
-
LWN ☛ Security updates for Thursday
Security updates have been issued by AlmaLinux (expat), Debian (chromium, commons-vfs, firefox-esr, php-horde-editor, php-horde-imp, and thunderbird), Fedora (corosync, firefox, nextcloud, and suricata), Mageia (curl and upx), Oracle (emacs, fence-agents, freetype, kernel, libreoffice, libxml2, nginx:1.24, podman, python-jinja2, and tigervnc), Red Hat (firefox and python-jinja2), SUSE (assimp, ffmpeg-4, firefox, ghostscript, GraphicsMagick, libxslt, and tomcat), and Ubuntu (linux, linux-aws, linux-aws-5.15, linux-gcp, linux-gke, linux-gkeop,
linux-ibm, linux-intel-iotg, linux-kvm, linux-lowlatency,
linux-lowlatency-hwe-5.15, linux-meta-raspi, linux-nvidia-tegra,
linux-oracle, linux-oracle-5.15, linux-raspi, linux, linux-azure, linux-azure-5.4, linux-bluefield, linux-gcp,
linux-ibm, linux-kvm, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux-fips, linux-fips, linux-aws-fips, linux-gcp-fips, linux-hwe-5.15, and linux-realtime, linux-intel-iot-realtime).
-
The Register UK ☛ Unknown scanners probing Juniper and Palo Alto products
On Wednesday, SANS Institute's Johannes Ullrich said he noticed a surge in scans for the username "t128," which, when accompanied by the password "128tRoutes," is a well-known default account for Juniper's Session Smart Networking products.
"About 3,000 source IPs took part in these scans," reported Ullrich, the dean of research at the infosec education and training outfit.
-
Security Week ☛ Google Released Second Fix for Quick Share Flaws After Patch Bypass
Google’s patches for Quick Share for backdoored Windows vulnerabilities leading to remote code execution were incomplete and could be easily bypassed.
-
Silicon Angle ☛ Oracle reportedly informs clients of system breach following earlier denial
Oracle Corp. has reportedly told some customers that a hacker broke into computer systems and stole old client login credentials. The admission comes after the company publicly denied any breach had taken place following a hacker offering allegedly stolen Oracle data on BreachForums.
-
Adaptiva Expands OneSite Patch to Mac and Linux, Delivering Cross-Platform Patching at Scale
-
Additional details on Outlaw Linux cryptomining botnet emerge
Vulnerable SSH servers have been primarily targeted by the Outlaw Linux cryptocurrency mining botnet, also known as Dota, which could self-propagate through its BLITZ initial access component, The Hacker News reports.
-
Standards/Consortia
-
The Register UK ☛ CISA, FBI, nations warn of fast flux DNS threat
Fast flux refers to a technique for obscuring malicious servers by, rather simply, rapidly altering their Domain Name System (DNS) records.
CISA, the FBI, and cyber authorities in Australia, Canada, and New Zealand – evidently still on speaking terms with the US despite threats of annexation – consider such DNS deception a threat to national security. Fast flux may be less troubling than saber-rattling by a head of state but it is an active threat rather than a proposed one.
-