Category Archives: security update

Dell fixes high-risk vulnerability in pre-installed SupportAssist software

Dell pushed out fixes for a high-risk vulnerability in its pre-installed SupportAssist software and urges users who don’t have auto updating enabled to upgrade the software manually. About the vulnerability (CVE-2019-12280) Dell SupportAssist software, which comes pre-installed on most Dell laptops and computers running Windows, has administrator-level access to the operating system (via a signed driver) because it must be able to identify issues, run diagnostics, driver-update scans, and install drivers. In May, researcher Bill … More

The post Dell fixes high-risk vulnerability in pre-installed SupportAssist software appeared first on Help Net Security.

Cisco fixes critical vulnerabilities in its SD-WAN, DNA Center solutions

Cisco has released another batch of fixes for many of its products, including its SD-WAN and DNA Center solutions, its Email Security Appliance, Security Manager, SOHO routers/firewalls, and more. Critical flaws CVE-2019-1625 could allow an authenticated, local attacker to elevate lower-level privileges to the root user on a device running a vulnerable version of the Cisco SD-WAN Solution. Cisco SD-WAN on a number of Cisco’s vEdge routers, its vBond Orchestrator Software, its vSmart Controller Software, … More

The post Cisco fixes critical vulnerabilities in its SD-WAN, DNA Center solutions appeared first on Help Net Security.

Mozilla plugs critical Firefox zero-day used in targeted attacks

A critical Firefox zero-day remote code execution vulnerability is being abused in targeted attacks in the wild, Mozilla has warned on Tuesday. About the vulnerability (CVE-2019-11707) Mozilla did not share many details about the flaw – it simply stated that it is a type confusion vulnerability that can occur when manipulating JavaScript objects due to issues in Array.pop, and that it can trigger an exploitable crash. The flaw can be exploited to achieve arbitrary code … More

The post Mozilla plugs critical Firefox zero-day used in targeted attacks appeared first on Help Net Security.

Vulnerabilities allow attackers to take over infusion pumps

Two vulnerabilities in Windows CE-powered Alaris Gateway Workstations (AWGs), which provide support for widely used infusion pumps, could allow remote attackers to disable the device, install malware, report false information, and even instruct the pumps to alter drug dosages and infusion rates. About Alaris Gateway Workstations Developed by US-based medical device maker Becton, Dickinson and Company (BD), Alaris Gateway Workstations are deployed in healthcare establishments in Europe and Asia. A company spokesperson told TechCrunch that … More

The post Vulnerabilities allow attackers to take over infusion pumps appeared first on Help Net Security.

June 2019 Patch Tuesday: A little something for everybody

For June 2019 Patch Tuesday, Microsoft has fixed a whooping 88 CVE-numbered vulnerabilities, Adobe has plugged many critical security holes in ColdFusion and Flash Player, and Intel has released security updates and mitigations for multiple products. Adobe’s fixes The Flash Player updates plug one but critical code execution flaw (CVE-2019-7845). Users of the ColdFusion web application development platform are getting patches for three critical code execution bugs and should consult the offered tech notes to … More

The post June 2019 Patch Tuesday: A little something for everybody appeared first on Help Net Security.

Attackers are exploiting WordPress plugin flaw to inject malicious scripts

Attackers are leveraging an easily exploitable bug in the popular WP Live Chat Support plugin to inject a malicious JavaScript in vulnerable sites, Zscaler warns. The company has discovered 47 affected sites (some have been cleaned up in the meantime) but that number is unlikely to be final. The source of the compromise The stored cross-site script vulnerability vulnerability the attackers are exploiting was discovered by Sucuri researchers earlier this year and the plugin developers … More

The post Attackers are exploiting WordPress plugin flaw to inject malicious scripts appeared first on Help Net Security.

CVE-2019-11815: Experts discovered a privilege escalation vulnerability in the Linux Kernel

Red Hat engineers and experts discovered a memory corruption vulnerability in Linux kernel, which is basically a flaw while implementation of RDS (Remote desktop Protocol) over TCP. This flaw has affected Red Hat, Ubuntu, Debian and SUSE and security advisories have been issued for all. This flaw could enable an…

Microsoft updates break AV software, again!

Microsoft’s May 2019 security fixes have again disrupted the normal functioning of some endpoint security products on certain Windows versions. Current problems “We have had a few customers reporting that following on from the Microsoft Windows 14th May patches they are experiencing a hang on boot where the machines appear to get stuck on ‘Configuring 30%’,” UK-based Sophos explained. “We have currently only identified the issue on a few customers running Windows 7 and Windows … More

The post Microsoft updates break AV software, again! appeared first on Help Net Security.

Intel MDS attack mitigation: An overview

Intel has revealed on Tuesday that some of its CPUs are vulnerable to a number of new speculative execution attacks that may allow attackers to stealing sensitive data and keys/passwords. ZombieLoad, RIDL and Fallout attacks have been extensively written about by the various groups of researchers that came up with them, but many customers and enterprise users are still unclear on whether these could affect them and what they can do to protect themselves. A … More

The post Intel MDS attack mitigation: An overview appeared first on Help Net Security.