Most of us who manage servers or are generally interested in cyber security are subscribed to various lists, feeds, etc. in an effort to stay up to date. Unfortunately those resources are often either disjointed, incomplete, or ridiculously verbose.
This thread is intended to be a curated list of vulnerabilities, updates and security advisories.
If you see an advisory that you think is relevant to this community, please post it here.
This thread is not intended to be for lengthy discussion. If you want to discuss at length, please link the post into a new topic.
this is a heads-up that there will be Samba security updates on
Tuesday, August 14th (~ 8-11am UTC). Please make sure that your Samba
servers will be updated soon after the release!
WhatsApp flaw allows others to modify group messages and usernames
In essence what this allows:
Abuse the āquoteā feature in a group chats to change the identity of the sender, even if that person is not a member of the group.
Alter the text of someone elseās reply.
Send a private message to another group participant that is disguised as a public message for all, so when the targeted individual responds, itās visible to everyone in the conversation.
If youāre one of those that manually updates Apps:
Update yo Apps!
Be wary of group message texts that suddenly change.
It sounds like you could effectively ddos the target without needing access to a huge amount of bandwidth (like a botnet). Itās not critical, but I thought it was relevant because of how many people here run pfsense. If it was a Fedora issue or something, I probably wouldnāt post it.
Iāll let @catsay address your concerns in detail, but as far as this thread goes, the posts donāt all need to be vulnerabilities. Any security-related advisories and update advisories that are relevant to the L1T community are fine.
The DEBUGCTL MSR contains several debugging features, some of which virtualise
cleanly, but some do not. In particular, Branch Trace Store is not
virtualised by the processor, and software has to be careful to configure it
suitably not to lock up the core. As a result, it must only be available to
fully trusted guests.
Unfortunately, in the case that vPMU is disabled, all value checking was
skipped, allowing the guest to chose any MSR_DEBUGCTL setting it likes.
IMPACT
A malicious or buggy guest administrator can lock up the entire host, causing
a Denial of Service.
VULNERABLE SYSTEMS
Xen versions 4.6 and later are vulnerable.
Only systems using Intel CPUs are affected. ARM and AMD systems are
unaffected.
Only x86 HVM or PVH guests can exploit the vulnerability. x86 PV guests
cannot exploit the vulnerability.
Running only x86 PV guests avoids the vulnerability.
