Alte Sicherheitsmeldungen

Datum		Beschreibung
09.04.2025 12:34		Phishing "Dringende Aufgabe "	Details
Phishing "Dringende Aufgabe " Zur Zeit sind Phishing Mails mit dem Betreff "Dringende Aufgabe" im Umlauf. Bitte ignorieren und l?schen Sie diese E-Mails. Erzeugt: 09.04.2025 12:34
01.07.2024 17:54		[SA] Critical Remote Exploitable Vulnerability in OpenSSH – CVE-2024-6387	Details
[SA] Critical Remote Exploitable Vulnerability in OpenSSH – CVE-2024-6387 [SA] Critical Remote Exploitable Vulnerability in OpenSSH – CVE-2024-6387 Overview OpenSSH maintainers have released security updates to contain a critical security flaw that could result in unauthenticated remote code execution with root privileges in glibc-based Linux systems. Affected platforms and versions RCE in OpenSSH's server, on glibc-based Linux systems: • OpenSSH < 4.4p1 is vulnerable to this signal handler race condition, if not backport-patched against CVE-2006-5051, or not patched against CVE-2008-4109, which was an incorrect fix for CVE-2006-5051; • 8.5p1 <= OpenSSH < 9.8p1 is vulnerable again to this signal handler race condition (because the "#ifdef DO_LOG_SAFE_IN_SIGHAND" was accidentally removed from sigdie()). Impact • The vulnerability, which is a signal handler race condition in OpenSSH’s server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems; that presents a significant security risk. Advisory 1. Patch Management: Quickly apply available patches for OpenSSH and prioritize ongoing update processes. 2. Enhanced Access Control: Limit SSH access through network-based controls to minimize the attack risks. 3. Network Segmentation and Intrusion Detection: Divide networks to restrict unauthorized access and lateral movements within critical environments and deploy systems to monitor and alert on unusual activities indicative of exploitation attempts. References • https://www.openssh.com/txt/release-9.8 • https://thehackernews.com/2024/07/new-openssh-vulnerability-could-lead-to.h[..] Erzeugt: 08.07.2024 17:50
13.11.2023 10:43		Phishing "Hinweis zum Ablauf des Kennworts"	Details
Phishing "Hinweis zum Ablauf des Kennworts" Zur Zeit sind Phishing Mails mit dem Betreff "Hinweis zum Ablauf des Kennworts" im Umlauf. Bitte ignorieren und l?schen Sie diese E-Mails. Erzeugt: 13.11.2023 10:43