Securty Products – Notebook
Sysadmins tending Samba need to get patching. Samba’s announcement, here1, explains that it’s suffering from a remote code execution bug that applies to all versions newer than Samba 3.5.0. The software, currently at version 4.6.4, provides *nix integration with Windows file and print services.
In CVE-2017-7494, a malicious client can upload a shared library to a writable share, and then cause the server to load and execute it. The advisory is scant on how this happened, but if The Register’s reading of the patch note2 is accurate, the bug’s in Samba’s RPC (remote procedure call) server component. Apparently, the unpatched RPC server accepted pipe names that included the character in other words, it looks like a directory traversal bug (feel free to correct us in the comments), so the fix is to refuse to open a connection if the pipe matches the regex %sn.
HD Moore Tweeted that the bug could be exploited with a single line:
British doctor and his fianc e murdered by former security guard who slit their throats in brutal penthouse attack
A British doctor and his fianc e were brutally murdered after having their throats cut by a former security guard of their luxury penthouse. Dr Richard Field, originally from London, and Dr Lina Bolanos were killed after Bampumim Teixeira burst into their luxury $1.9million Bhome in Boston, Massachusetts, on Friday evening. The terrified anaesthetist managed to send a text to a friend saying an ‘armed man’ had entered their apartment, but by the time police arrived, the couple were already dead.
Inside police found both with their hands tied and throats cut.
Bampumim Teixeira in hospital where he was charged with two counts of murder (Photo: REUTERS) A judge charged Texeira as he lay in hospital (Photo: REUTERS)
Yesterday Teixeira, who officials say wrote a ‘message of revenge’ on the couple s walls, was arraigned on two counts of murder by a judge at his hospital bedside. The 30-year-old was shot in the hand, stomach and leg during a shootout with police before he was detained. He entered two not-guilty pleas at Tufts Medical Centre in Boston.
Before he died Dr Field, 49, had texted a friend saying a gunman in the house . The pal then called police but when they arrived the Brit and Dr Bolanos, 38, were already dead.
Richard Field and Lina Bolanos (Photo: Facebook) Dr Field was originally from London (Photo: Facebook)
Police later found a black backpack in a remarkably conspicuous area”. Inside, the backpack was filled with jewellery, “presumably belonging to Miss Bolanos.
Judge Michael Bolden ordered Teixeira to be held without bail, which was not contested by the accused’s court-appointed defence attorney Steve Sack. Teixeira, of nearby Chelsea, had recently been released from jail, having passed notes demanding money from a bank on two occasions, according to prosecutors. He is next due in court date on June 8.
By the time police arrived, the couple were both dead (Photo: Facebook) The luxury condo where the couple were found butchered (Photo: WBZ)
According to reports Dr Field was born in Hammersmith, west London, and graduated from Sheffield University’s medical school in 1999. Dr Field worked at the Brigham and Women’s Hospital, an affiliate of Harvard Medical School. Paying tribute, one patient wrote on Facebook: “He was an amazing Dr .
who was so kind and compassionate.
“I always said if he ever moved back to England I would follow him . Dr Field changed my life.”
The Foreign & Commonwealth Office has not confirmed his nationality. Dr Bolanos worked at Massachusetts Eye and Ear hospital as a paediatric anaesthetist and was an instructor at the Harvard Medical School.
John Fernandez, the hospital’s president, said: “Dr Bolanos was an outstanding paediatric anaesthetist and a wonderful colleague in the prime of both her career and life.”
IT HAS been confirmed that a new contractor will be taking over the 2017’s Royal Highland Show security operation. SHOWSEC has been named as the new organisation a company that claims to be an “award winning event and venue security specialist dedicated to achieving excellence in crowd management”. In business for more than 30 years, SHOWSEC has serviced thousands of events at over 450 venues, managing the safety of over 25 million people at sports, concerts, festivals and public events each year. Following last year’s Highland Show, claims were made on social media that a number of items of properly were stolen from the Young Farmers campsite, and it was alleged that it was the security team, Streamline Security, that had taken them. Some of these allegations included: One young farmer had her phone charging in the cabin next to the security booth . When she returned, her phone and charger had gone . She was told nothing had been handed in and that the lost property box was empty . A guard then rang her phone and she could hear it ringing .
She then saw her phone flash under piles of paper on a desk . Only then, reportedly, was she told that it had been handed in. Laura Cochrane, from central Scotland, dropped her purse on Saturday night at the paint party dance . She checked at the security booth . Five minutes later, a friend got the purse from a guard . It had no cash in it, and when she asked who handed it in, was told it was confidential information . A Lanarkshire young farmer s wallet went missing . It was handed back by a security guard, minus the cash. It was reported on Facebook that while a young farmer was lying in a room within a caravan, a security guard let himself into the caravan and, when challenged, left immediately .
This was reported to the head security guard. At the time, Streamline s managing director, William Hunter, said: I can confirm that a mobile phone was found in the possession of one of Streamline s bar staff . Following an investigation, the staff member was fired and the phone is being returned to the owner . We have passed details of the incident to the police . This is the only incident reported to either ourselves or Police Scotland.” Royal Highland Show manager, David Jackson, also commented in the 2016 show aftermath: These are concerning allegations and we will work with Police Scotland and Streamline Leisure to investigate and take appropriate action. This week, The Scottish Farmer asked the Royal Highland Show’s public relations spokesman if last year’s row was the reason for the change of security provider, but had received no reply at time of going to press.