Suche
Beiträge, die mit security getaggt sind
That could allow a local attacker to gain root privileges without requiring user interaction. Needrestart is a utility that scans a system to determine the services that need to be restarted after applying shared library updates.
https://blog.qualys.com/vulnerabilities-threat-research/2024/11/19/qualys-tru-uncovers-five-local-privilege-escalation-vulnerabilities-in-needrestart
#linux #ubuntu #it #security #privacy #engineer #tech #media #news
![Multiple decade-old security vulnerabilities have been disclosed in the needrestart package.
The vulnerabilities are believed to have existed since the introduction of interpreter support in needrestart 0.8, which was released on April 27, 2014.
"These needrestart exploits allow Local Privilege Escalation (LPE) which means that a local attacker is able to gain root privileges," Ubuntu said in an advisory, noting they have been addressed in version 3.8.
<https://ubuntu.com/blog/needrestart-local-privilege-escalation>
The 5 flaws are listed below:
• CVE-2024-48990 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
• CVE-2024-48991 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by winning a race condition & tricking needrestart into running their own, fake Python interpreter.
• CVE-2024-48992 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
• CVE-2024-11003 [CVSS score: 7.8] and CVE-2024-10224 [CVSS score: 5.3] - Two vulnerabilities that allows a local attacker to execute arbitrary shell commands as root by taking advantage of an issue in the libmodule-scandeps-perl package. (before version 1.36)](https://nerdculture.de/system/media_attachments/files/113/521/649/340/089/036/original/9c79a893744b5d47.jpeg "Multiple decade-old security vulnerabilities have been disclosed in the needrestart package.
The vulnerabilities are believed to have existed since the introduction of interpreter support in needrestart 0.8, which was released on April 27, 2014.
\"These needrestart exploits allow Local Privilege Escalation (LPE) which means that a local attacker is able to gain root privileges,\" Ubuntu said in an advisory, noting they have been addressed in version 3.8.
<https://ubuntu.com/blog/needrestart-local-privilege-escalation>
The 5 flaws are listed below:
• CVE-2024-48990 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.
• CVE-2024-48991 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by winning a race condition & tricking needrestart into running their own, fake Python interpreter.
• CVE-2024-48992 [CVSS score: 7.8] - A vulnerability that allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable.
• CVE-2024-11003 [CVSS score: 7.8] and CVE-2024-10224 [CVSS score: 5.3] - Two vulnerabilities that allows a local attacker to execute arbitrary shell commands as root by taking advantage of an issue in the libmodule-scandeps-perl package. (before version 1.36)")
Qualys TRU Uncovers Five Local Privilege Escalation Vulnerabilities in needrestart | Qualys Security Blog
The Qualys Threat Research Unit (TRU) has identified five Local Privilege Escalation (LPE) vulnerabilities within the needrestart component…Saeed Abbasi (Qualys, Inc.)
T-Mobile has joined a list of major organizations like AT&T, Verizon & Lumen Technologies that have been singled out as part of what appears to be a full-blown Chinese threat actors cyber espionage campaign.
https://www.wsj.com/politics/national-security/t-mobile-hacked-in-massive-chinese-breach-of-telecom-networks-4b2d7f92
#us #telecom #companies #breach #it #security #privacy #engineer #media #tech #news
The makings of a grand Trump deal in the Middle East
Former Israeli Prime Minister Ehud Barak says it’s possible the new U.S. administration may enter into interconnected talks with Putin about Ukraine, Iran and the Middle East.Jamie Dettmer (POLITICO)
Gaza Security Forces Ambush Gang Accused of Looting Aid with Israeli Support
The gang members are “operating in cooperation with the Israeli forces” to target aid convoys, Hamas’s Basem Naim said.Sharif Abdel Kouddous (Drop Site News)
So on one hand this looks like a programme of communicative disruption... but one might wonder whether its a sign of the start of something else (my old IR training leads me to pose the Q. at least).
#internet #communications #security
h/t FT
Israeli Strikes Reportedly Destroy Iran’s Covert Nuclear Facility - EUROPE SAYS
What You Need to Know: Israeli airstrikes in late October reportedly destroyed Talegahn 2, a covert Iranian nuclearEUROPE SAYS (EUROPESAYS.COM)
eSIM security vs. a physical SIM: An eSIM is safer
Apart from, the convenience of being able to easily enable an eSIM (without waiting for a physical SIM delivery), the ease of switching SIM profiles when travelling, and not having a physical card that gets damaged, these eSIMs also have some security advantages too.
eSIM (embedded subscriber identity module) technology employs various additional security measures that make it less prone to hacking than physical SIMs. Those measures include a secure element, which stores sensitive data and protects it from unauthorized access or tampering, adding an extra layer of protection against hacking attempts.
They cannot be cloned, as they cannot be physically accessed from outside the phone. Also, if your phone is stolen, it is not like a physical SIM where a thief can just remove the SIM card (the eSIM is always active inside the phone).
In other aspects they are quite similar to physical SIM cards, for example, with SIM swapping, as SIM swapping is done virtually on the network side and has little to do with the SIM in your phone.
But remember that no online device is ever fully immune to hacking. So whilst eSIMs are a step up from physical SIM cards, they may not be fully immune.
See https://nordvpn.com/blog/is-esim-safe
#Blog, #eSIM, #security, #technology
Microsoft’s November Patch Update fixes 91 Windows security vulnerabilities, including 4 zero-days. The critical fixes address actively exploited flaws in Windows. It is strongly recommended that users apply these updates as soon as possible to mitigate possible security risks. Updates can be installed via Windows Update.
https://msrc.microsoft.com/update-guide/
#microsoft #windows #update #it #security #privacy #engineer #media #tech #news
• Folgen: https://www.kuketz-blog.de/bleib-aktuell/
• Forum: https://www.kuketz-forum.de/
• Chat: https://www.kuketz-blog.de/chat/
Bleib informiert und diskutiere mit!
#blog #sicherheit #security #datenschutz #privacy #mastodon #newsletter #rss #matrix #signal #discourse #forum
Bleib aktuell
RSS, Newsletter oder Social Media: Immer informiert über neue Beiträge • IT-Sicherheit & Datenschutz aus Karlsruhewww.kuketz-blog.de
The focus of civil society has been taken up with climate change as an existential threat, so the build up of nukes in the US, China & Russia has (perhaps) escaped out notice.... Now Jessica Matthews (Carnegie) sees a revival of the sorts of nuclear politics that for those around my age (now in our 50s/60s) will be both familiar from our past & likely unwelcome.... it doesn't look good.
#NuclearWeapons #security
https://www.theguardian.com/world/2024/nov/14/nuclear-weapons-war-new-arms-race-russia-china-us
Amid an economic crisis caused by Israeli policies and Palestinian Authority corruption, teachers are bringing #schools and streets to a standstill until their demands are met: https://www.972mag.com/palestinian-teachers-strike-pa-repression/ #WestBank #Gaza #occupation #education #security
Defying PA repression, Palestinian teachers lead biggest strike in years
Amid an economic crisis caused by Israeli policies and PA corruption, teachers are bringing schools and streets to a standstill until their demands are met.Ben Reiff (+972 Magazine)
Wired has published a guide to protecting yourself from surveillance by the US government
The guide discusses the potential increase in government surveillance under a second Trump administration and offers advice on upgrading personal privacy protections, including using end-to-end encrypted messengers and securing devices.
#privacy #security #civilrights
Google fixed two actively exploited Android zero-day flaws as part of its November security updates, addressing a total of 51 vulnerabilities. Tracked as CVE-2024-43047 & CVE-2024-43093, the two issues are marked as exploited in limited, targeted attacks.
https://source.android.com/docs/security/bulletin/2024-11-01
#google #android #update #zerodays #it #security #privacy #engineer #media #tech #news
#privacy #security #anonymity #journalism #whistleblowing
https://mullvad.net
#privacy #security #VPN #AzireVPN #MullvadVPN
Mullvad VPN - Free the internet
Free the internet from mass surveillance and censorship. Fight for privacy with Mullvad VPN and Mullvad Browser.Mullvad
With Trump, Netanyahu’s got his work cut out for him
“Trump’s not going to give him a blank check.”Jamie Dettmer (POLITICO)
New Russian church raises suspicions in Swedish town
It’s feared Russia could use the church as cover for future intelligence or sabotage operations.Charlie Duxbury (POLITICO)
-- Niccolo Machiavelli
⬆ #Wisdom #Quotes #NiccoloMachiavelli #Security #Vice #Virtue
⬇ #Photography #Panorama #Palms #Florida
Iran’s Nuclear Program Can’t Be Bombed Out of Existence - EUROPE SAYS
The Middle East is on the brink of full-scale regional war. Israel recently launched retaliatory strikes against Iran.EUROPE SAYS (EUROPESAYS.COM)
Security Boosted For France-Israel Match - EUROPE SAYS
Text size A high police presence is being prepared for the France v Israel Nations League match atEUROPE SAYS (EUROPESAYS.COM)
Greece’s main opposition further dismantled – POLITICO - EUROPE SAYS
In September 2023, Kasselakis was elected from nowhere to head Syriza. Since then, the party has been miredEUROPE SAYS (EUROPESAYS.COM)
Greece’s main opposition further dismantled
Syriza party’s recently deposed leader Stefanos Kasselakis announced the creation of a new political movement, taking at least four MPs with him.Nektaria Stamouli (POLITICO)
Iran Update, November 8, 2024 - EUROPE SAYS
Iran Update, November 8, 2024 Johanna Moore, Siddhant Kishore, Annika Ganzeveld, Ben Rezaei, Avery Borens, Adiv Kuray,EUROPE SAYS (EUROPESAYS.COM)
(2019) https://www.declassifieduk.org/how-the-uk-security-services-neutralised-the-countrys-leading-liberal-newspaper/
#TheGuardian #Assange #Corbyn #MI5 #MI6 #LabourParty #Labour #England #Britain #UK #centreLeft #leftOfCentre #elections #UKPol #politics #SocialDemocracy #SocDem #media #security #manipulation #coOpting #conflation #confusion #antisemitism #Guardian #DumpTheGuardian #manufacturingConsent
How the UK Security Services neutralised the country's leading liberal newspaper
The Guardian, Britain’s leading liberal newspaper with a global reputation for independent and critical journalism, has been successfully targeted by security agencies.MARK CURTIS (Declassified Media ltd)
The end of Pax Americana
When the U.S. inaugurates Donald J. Trump as its 47th president, the country and world will be very different because of it.Ivo Daalder (POLITICO)
"In July 2024, ahead of the Summer Olympics in France, the threat actor hacked a French commercial dynamic display provider in an effort to show photo montages denouncing the participation of Israeli athletes in the #Olympics.
In addition, ASA has conducted IP camera hacking, mainly targeting devices in #Israel, but also in #Gaza and #Iran.
ASA made images and content from Israeli cameras available for clients to access via several servers beginning in October 2023...”
https://www.securityweek.com/us-israel-describe-iranian-hackers-targeting-of-olympics-surveillance-cameras/
French security officials detained in diplomatic spat in Jerusalem
Tensions have been rising between Israel and France over strikes in Lebanon and the war in Gaza.Clea Caulcutt (POLITICO)
https://scidsg.medium.com/how-to-check-your-iphone-for-pegasus-338bafb2358e
#threatmodel #security #iPhone #hacking #phishing #amnesty #journalism #opensource #press #law
▶️ We published a new article: "The New German #Security Package: #Digital #Surveillance and #DataProtection". More in our #blog: https://www.vioffice.de/blog/sicherheitspaket-digitale-ueberwachung/ 🇬🇧🇩🇪
▶️ ViOffice Cloud for free! Use our full ViOffice #Cloud with up to 3GB storage including all functions (storage, chat, videocall, groupware, taskboard, polls and more) for free. Register at: https://cloud01.vioffice.de/apps/registration/ 🚀
The new German Security Package: Digital Surveillance and Data Protection - ViOffice
The new German security package: far-reaching digital surveillance and possible intrusions into citizens' privacy.Pascal Langer (ViOffice)
Iran Update, November 5, 2024 - EUROPE SAYS
Iran Update, November 5, 2024 Carolyn Moorman, Johanna Moore, Annika Ganzeveld, Andie Perry, Siddhant Kishore, Ben Rezaei,EUROPE SAYS (EUROPESAYS.COM)
5 things to know about migration czar Magnus Brunner’s European Parliament hearing – POLITICO - EUROPE SAYS
It helped that after the first section of the hearing, MEPs didn’t have a chance to follow upEUROPE SAYS (EUROPESAYS.COM)
Israel’s Netanyahu fires defense minister, saying mutual trust has ‘cracked’
Yoav Gallant will be replaced in Cabinet by Foreign Minister Israel Katz.Elena Giordano (POLITICO)
The free version of the popular WordPress plugin LiteSpeed Cache has fixed a dangerous privilege elevation flaw on its latest release that could allow unauthenticated actors to gain admin rights.
[CVE-2024-50550 CVSS score: 8.1]
https://patchstack.com/articles/rare-case-of-privilege-escalation-patched-in-litespeed-cache-plugin/
#wordpress #litespeed #flaw #it #security #privacy #engineer #media #tech #news
Rare Case of Privilege Escalation Patched in LiteSpeed Cache Plugin - Patchstack
A vulnerability in LiteSpeed Cache allowed unauthorized admin access; fixed in version 6.5.2, with Patchstack users automatically protected.Rafie Muhammad (Patchstack)