#mac

By Jon Munshaw and Vanja Svajcer. Microsoft released its monthly security update Tuesday, disclosing more than 120 vulnerabilities across its line of products and software, the most in a single Patch Tuesday in four months.   This batch of updates also includes a fix for a new vulnerability in the Microsoft Windows Support Diagnostic Tool (MSDT) that’s actively being exploited in the wild, according to Microsoft. MSDT was already the target of the so-called “Follina” zero-day vulnerability in June.   In all, August’s Patch Tuesday includes 15 critical vulnerabilities and a single low- and moderate-severity issue. The remainder is classified as “important.”  Two of the important vulnerabilities CVE-2022-35743 and CVE-2022-34713 are remote code execution vulnerabilities in MSDT. However, only CVE-2022-34713 has been exploited in the wild and Microsoft considers it “more likely” to be exploited. Microsoft Exchange Server contains two critical elevation of privilege vulnerabilities, CVE-2...

Upcoming Black Hat USA presentation will examine the implications of Kerberos weaknesses for security on the local machine.

Browser adds defense in depth to prevent abuse of unpatched vulnerabilities

Red Hat Security Advisory 2022-5875-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.10.26.

Red Hat OpenShift Container Platform release 4.9.45 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2403: openshift: oauth-serving-cert configmap contains cluster certificate private key

Machine-learning algorithms alone may miss signs of a successful attack on your organization.

Categories: Business In this post, a cybersecurity expert gives his 6-point checklist of features your EDR should have to stop ransomware. (Read more...) The post Can your EDR handle a ransomware attack? 6-point checklist for an anti-ransomware EDR appeared first on Malwarebytes Labs.

**How could an attacker exploit this vulnerability?** An unauthenticated attacker could send a specially crafted connection request to a RAS server, which could lead to remote code execution (RCE) on the RAS server machine.

**How does this impact SCOM customers?** SCOM 2016, 2019, and 2022 customers who monitor Linux machines and use Kerberos-based authentication are impacted by this vulnerability. **How can an attacker exploit the vulnerability?** OMI supports Kerberos as one of the authentication mechanisms. This authentication mechanism is only used by SCOM, with no Azure service using it. A fixed temp file is used while keeping omi keytab in sync with the default keytab. The temp file can be manipulated by an attacker to insert a new key in the omi keytab and gain elevated privileges on the machine. The attacker must be locally logged in to the machine on which the OMI components are running. **What products are affected by this vulnerability and how can I protect myself?** The following table lists the affected services and the required customer action to protect against this vulnerability. Affected Product Fixed Version Number Customer action required OMI as standalone package OMI version ...

**How could an attacker exploit this vulnerability?** An unauthenticated attacker could send a specially crafted connection request to a RAS server, which could lead to remote code execution (RCE) on the RAS server machine.