Podcast Detail

SVG Phishing; FortiClient VPN Logging; Needrestart Vuln;

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://chrt.fm/track/2748D7/https://traffic.libsyn.com/securitypodcast/9230.mp3

SANS Daily Network Security Podcast (Stormcast) for Friday, November 22nd, 2024

00:00

My Next Class

Application Security: Securing Web Apps, APIs, and Microservices	Washington	Dec 13th - Dec 18th 2024
Application Security: Securing Web Apps, APIs, and Microservices	Online \| US Eastern	Jan 27th - Feb 1st 2025

… more classes

Interested in Internet Storm Center stickers? Check here if there are still some available for today.

Increase In Phishing SVG Attachments
https://isc.sans.edu/diary/Increase%20In%20Phishing%20SVG%20Attachments/31456

Logging blind spot revealed in FortiClient VPN
https://pentera.io/blog/FortiClient-VPN_logging-blind-spot-revealed/

Needrestart Vulnerability
https://www.qualys.com/2024/11/19/needrestart/needrestart.txt

iTunes

MP3 Download

RSS Feed

Google

Podbean

Amazon Echo

YouTube

Spreaker

Spotify

Discussion

The Shibboleth vulnerability is quite interesting. In their example, the SAML signature covers the entire and they've made modifications to it (the changes to the uid) that should cause the signature to fail validation. This vulnerability speaks to larger architectural issues with Shibboleth. Obviously the signature validation is happening on a DIFFERENT document (the inline DTD defs are resolved and replaced) than the attribute extraction code works on (the inline DTD variables are not replaced). This is a HUGE no no and leads to the confused deputy issues that caused the vulnerability. I would bet other SP SAML parsing code is making similar mistakes.

Posted by Anonymous on Tue Jan 16 2018, 16:54

Application Security: Securing Web Apps, APIs, and Microservices	Washington	Dec 13th - Dec 18th 2024
Application Security: Securing Web Apps, APIs, and Microservices	Online \| US Eastern	Jan 27th - Feb 1st 2025
Network Monitoring and Threat Detection In-Depth	Baltimore	Mar 3rd - Mar 8th 2025
Application Security: Securing Web Apps, APIs, and Microservices	Orlando	Apr 13th - Apr 18th 2025