| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Mon, 15 Mar 2021 10:05:31 -0400 From: Harrison Neal <hneal@...tdidibreak.com> To: fulldisclosure@...lists.org Subject: [FD] SolarWinds TFTP Server 11.0.4.101: Remote Unauthenticated Reconfiguration Older versions of SolarWinds' TFTP Server, which could have been installed from a standalone download or bundled with certain paid products, may have allowed unauthenticated remote users to change sensitive settings such as the TFTP root directory or IP-based security settings. In certain environments, this could lead to remote code execution, for example by allowing attackers to modify a web application hosted on the same server. Administrators should verify that installed SolarWinds products are fully updated. If the TFTP Server component is observed listening for TCP connections on an interface besides the loopback, consider using firewalls or a similar security mechanism to limit access to the listening TCP port. _______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/
Powered by blists - more mailing lists