{"vulnerability": "CVE-2024-28085", "sightings": [{"uuid": "f3ca9aa6-b4b5-49f1-b8cc-bf1e5bc328b9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-162-05", "content": "", "creation_timestamp": "2025-06-12T10:00:00.000000Z"}, {"uuid": "35c1765e-27fa-488c-b777-a7a3b21bb319", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "Telegram/Z5_dk9aHsug3Aaboqz37J5qq9R0sNH6j0ck4mFzTAEYe_Bg", "content": "", "creation_timestamp": "2024-03-29T14:32:19.000000Z"}, {"uuid": "293e5086-657b-4ba3-8e50-9257822109a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/cKure/12630", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 New Linux Bug Could Lead to User Password Leaks and Clipboard Hijacking.\n\nThe bug, tracked as CVE-2024-28085, has been codenamed WallEscape by security researcher Skyler Ferrante.\n\nhttps://thehackernews.com/2024/03/new-linux-bug-could-lead-to-user.html", "creation_timestamp": "2024-03-30T01:38:44.000000Z"}, {"uuid": "fb9f6f9e-ca83-473c-bf72-5818be7a5eb6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/8377", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01 \n\n\u66f4\u65b0\u4e86\uff1aCVE-2024\n\u63cf\u8ff0\uff1aExample Trojan  of CVE-2024-28085\nURL\uff1ahttps://github.com/oditynet/sleepall\n\n\u6807\u7b7e\uff1a#CVE-2024", "creation_timestamp": "2024-08-27T08:07:45.000000Z"}, {"uuid": "64fef4ec-72db-4ff5-a9aa-d7fc5579474b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/habr_com_news/26637", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0432\u044b\u044f\u0441\u043d\u0438\u043b\u0438, \u0447\u0442\u043e \u0432 \u043a\u043e\u0434\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b wall \u0438\u0437 \u043f\u0430\u043a\u0435\u0442\u0430 util-linux (\u0432\u0435\u0440\u0441\u0438\u0439 2.24 \u2014 2.39, \u043f\u0430\u0442\u0447 \u0432\u044b\u0448\u0435\u043b \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.40) \u0431\u043e\u043b\u0435\u0435 10 \u043b\u0435\u0442 (\u0441 \u043e\u043a\u0442\u044f\u0431\u0440\u044f 2013 \u0433\u043e\u0434\u0430) \u0431\u044b\u043b\u0430 \u0441\u043a\u0440\u044b\u0442\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Wall-Escape (CVE-2024-28085), \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u0447\u0435\u0440\u0435\u0437 \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u044e \u0441 escape-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044f\u043c\u0438.\n\n#\u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c #\u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0430", "creation_timestamp": "2024-03-29T13:58:32.000000Z"}, {"uuid": "fe7a1a51-4bd1-467e-a02b-7e94b5b7702c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "Telegram/BGApFPAHoLEhVXDwAbaWgtJkmhuVFcjx1S2FNIIWCNfBUw", "content": "", "creation_timestamp": "2024-03-29T15:03:34.000000Z"}, {"uuid": "23555b5c-335f-4e36-ac16-4055bea0f188", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/tengkorakcybercrewz/4543", "content": "The Hacker News\nNew Linux Bug Could Lead to User Password Leaks and Clipboard Hijacking\n\nDetails have emerged about a vulnerability impacting the \"wall\" command of the util-linux package that could be potentially exploited by a bad actor to leak a user's password or alter the clipboard on certain Linux distributions.\nThe bug, tracked as CVE-2024-28085, has been codenamed WallEscape by security researcher Skyler Ferrante. It has been described as a case of improper", "creation_timestamp": "2024-03-29T15:03:35.000000Z"}, {"uuid": "d6737c5e-80b0-4d1d-bfd1-e32aa757662a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "published-proof-of-concept", "source": "Telegram/t5hGOlrQ4D0rlr1YS_pQ9bSCnxZuA8zvL9vU1_E7ROf5GA", "content": "", "creation_timestamp": "2024-03-29T12:15:54.000000Z"}, {"uuid": "af2b51db-ab04-4d74-9dd7-af2e02d1e364", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/tengkorakcybercrewz/864", "content": "The Hacker News\nNew Linux Bug Could Lead to User Password Leaks and Clipboard Hijacking\n\nDetails have emerged about a vulnerability impacting the \"wall\" command of the util-linux package that could be potentially exploited by a bad actor to leak a user's password or alter the clipboard on certain Linux distributions.\nThe bug, tracked as CVE-2024-28085, has been codenamed WallEscape by security researcher Skyler Ferrante. It has been described as a case of improper", "creation_timestamp": "2024-03-29T15:03:35.000000Z"}, {"uuid": "6663d467-b1d8-4173-a9f5-0821b49a9ebb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/KomunitiSiber/1709", "content": "New Linux Bug Could Lead to User Password Leaks and Clipboard Hijacking\nhttps://thehackernews.com/2024/03/new-linux-bug-could-lead-to-user.html\n\nDetails have emerged about a vulnerability impacting the \"wall\" command of the util-linux package that could be potentially exploited by a bad actor to leak a user's password or alter the clipboard on certain Linux distributions.\nThe bug, tracked as CVE-2024-28085, has been codenamed\u00a0WallEscape\u00a0by security researcher Skyler Ferrante. It has been described as a case of improper", "creation_timestamp": "2024-03-29T12:09:59.000000Z"}, {"uuid": "656c1331-a120-4d10-8135-3d10836e624a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/proxy_bar/1971", "content": "CVE-2024-28085 - \u0421\u043c\u0435\u0448\u043d\u0430\u044f \u0434\u044b\u0440\u043a\u0430 \u0432 Linux \ud83d\ude1c\n*\n\u0414\u044b\u0440\u043a\u0435 11 \u043b\u0435\u0442, \u0434\u044b\u0440\u043a\u0430 \u0435\u0441\u0442\u044c \u0432 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0438 \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0432\u044b\u0448\u043b\u043e 27 \u043c\u0430\u0440\u0442\u0430 2024 \u0433\u043e\u0434\u0430.\n\u0414\u044b\u0440\u043a\u0430 \u043f\u0440\u043e\u0432\u0435\u0440\u0435\u043d\u0430 \u043d\u0430 Ubuntu 22.04 LTS \u0438 Debian 12.5\n\u041d\u043e \u0435\u0441\u0442\u044c \u043d\u044c\u044e\u0430\u043d\u0441, \u043d\u0443\u0436\u043d\u043e \u0443\u0436\u0435 \u0431\u044b\u0442\u044c \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0435.\n*\n\u0412 \u043e\u0431\u0449\u0435\u043c \u043f\u043e\u0447\u0438\u0442\u0430\u0439\u0442\u0435, \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u044b\u0435 sudo \u0437\u0430\u043f\u0440\u043e\u0441\u044b\n*\nPOC\n \n#linux #sudo", "creation_timestamp": "2024-03-29T05:47:29.000000Z"}, {"uuid": "af1f17ae-46f4-4eda-998f-0e689e8ba28c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "published-proof-of-concept", "source": "https://t.me/true_secator/5585", "content": "\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c WallEscape \u0432 \u0443\u0442\u0438\u043b\u0438\u0442\u0435 wall \u043f\u0440\u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043b\u0430 \u0432\u043e \u0432\u0441\u0435\u0445 \u0432\u0435\u0440\u0441\u0438\u044f\u0445 \u043f\u0430\u043a\u0435\u0442\u0430 util-linux \u0431\u043e\u043b\u0435\u0435 10 \u043b\u0435\u0442.\n\nCVE-2024-28085 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u0430\u0442\u0430\u043a\u0443 \u043d\u0430 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u044b \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u0443\u0442\u0451\u043c \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u044f\u0446\u0438\u0438 \u0441 escape-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u044f\u043c\u0438.\n\n\u0418\u0441\u0442\u043e\u0440\u0438\u044f \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0430 \u0434\u043e\u0441\u0442\u0430\u0442\u043e\u0447\u043d\u043e \u043f\u0440\u043e\u0437\u0430\u0438\u0447\u043d\u0430, \u0432\u0435\u0434\u044c \u0445\u043e\u0442\u0435\u043b\u0438 \u043a\u0430\u043a \u043b\u0443\u0447\u0448\u0435, \u0430 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u043e\u0441\u044c \u043a\u0430\u043a \u0432\u0441\u0435\u0433\u0434\u0430.\n\n\u0420\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0438 \u043f\u0440\u0438 \u0434\u043e\u0431\u0430\u0432\u043b\u0435\u043d\u0438\u0438 \u0432 \u0432\u0435\u0440\u0441\u0438\u0438 2.24 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u043d\u043e\u0439 \u0441\u0442\u0440\u043e\u043a\u0435 \u043f\u043e\u043f\u0440\u043e\u0441\u0442\u0443 \u043d\u0435 \u043f\u0440\u0435\u0434\u0443\u0441\u043c\u043e\u0442\u0440\u0435\u043b\u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0430\u0446\u0438\u044e escape-\u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439.\n\n\u0412 \u0441\u0432\u044f\u0437\u0438 \u0441 \u0447\u0435\u043c \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043e\u043a \u043c\u043e\u0433 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u043c \u0434\u043b\u044f \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u044f \u043f\u043e\u0434\u0434\u0435\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u044f SUDO \u043d\u0430 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b\u0430\u0445 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u0432\u043e\u0448\u0435\u0434\u0448\u0438\u0445 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0443, \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043e\u0431\u043c\u0430\u043d\u044b\u0432\u0430\u044f \u0438\u0445 \u0438 \u0437\u0430\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u0432\u0432\u043e\u0434\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u0438\u0432\u043d\u044b\u0439 \u043f\u0430\u0440\u043e\u043b\u044c.\n\n\u0414\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043e\u043b\u0436\u043d\u044b \u0431\u044b\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u044b \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f: \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u043d\u044b\u0445 \u043a Linux-\u0441\u0435\u0440\u0432\u0435\u0440\u0443 \u0447\u0435\u0440\u0435\u0437 \u0442\u0435\u0440\u043c\u0438\u043d\u0430\u043b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0443\u0442\u0438\u043b\u0438\u0442\u044b 'mesg' \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043d\u0430\u043b\u0438\u0447\u0438\u0435\u043c \u0443 \u043a\u043e\u043c\u0430\u043d\u0434\u044b wall \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u0439 setgid.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0430 \u0432 Ubuntu 22.04 LTS (Jammy Jellyfish) \u0438 Debian 12.5 (Bookworm), \u043d\u043e \u043d\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 CentOS.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0443 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0421\u043a\u0430\u0439\u043b\u0435\u0440 \u0424\u0435\u0440\u0440\u0430\u043d\u0442\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u0443\u0436\u0435 \u043e\u043f\u0443\u0431\u043b\u0438\u043a\u043e\u0432\u0430\u043b PoC \u0438 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u044b\u0435 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438, \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0438\u0440\u0443\u044e\u0449\u0438\u0435, \u043a\u0430\u043a \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u043e\u043f\u0438\u0441\u0430\u043b \u043c\u0435\u0442\u043e\u0434\u0438\u043a\u0443, \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u0432\u0432\u0435\u0441\u0442\u0438 \u0441\u0432\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c, \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u044f \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u044b \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043c\u043e\u043c\u0435\u043d\u0442, \u043a\u043e\u0433\u0434\u0430 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044c \u0432\u0432\u043e\u0434\u0438\u0442 \u0441\u0432\u043e\u0439 \u043f\u0430\u0440\u043e\u043b\u044c \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b sudo.\n\n\u041f\u043e\u0441\u043b\u0435 \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u044b sudo \u0430\u0442\u0430\u043a\u0443\u044e\u0449\u0438\u0439 \u043c\u043e\u0436\u0435\u0442 \u043e\u0442\u043f\u0440\u0430\u0432\u0438\u0442\u044c \u0447\u0435\u0440\u0435\u0437 wall \u0444\u0438\u043a\u0442\u0438\u0432\u043d\u043e\u0435 \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u0435 \u0441 \u043f\u0440\u0438\u0433\u043b\u0430\u0448\u0435\u043d\u0438\u0435\u043c \u043a \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u043c\u0443 \u0432\u0432\u043e\u0434\u0443 \u043f\u0430\u0440\u043e\u043b\u044f, \u0447\u0442\u043e \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u0435\u0433\u043e \u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0430\u0446\u0438\u0438.", "creation_timestamp": "2024-03-29T16:30:05.000000Z"}, {"uuid": "d8c833fc-b8d3-4eea-9366-366bbd5c0407", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/ctinow/213097", "content": "https://ift.tt/h36Jcyi\nEscape sequence injection in util-linux wall (CVE-2024-28085)", "creation_timestamp": "2024-03-27T17:32:04.000000Z"}, {"uuid": "3f370144-c008-4f6d-8552-b428e64db38c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/thehackernews/4753", "content": "\ud83d\udcbb A new vulnerability, CVE-2024-28085, dubbed \"WallEscape,\" impacts the \"wall\" command in util-linux, potentially exposing passwords or altering clipboards on Linux distros like Ubuntu & Debian. \n \nRead more \u279f https://thehackernews.com/2024/03/new-linux-bug-could-lead-to-user.html", "creation_timestamp": "2024-03-29T12:02:12.000000Z"}, {"uuid": "a1b92e41-9339-4ac9-8968-ddfb3f4ab0a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/10235", "content": "#exploit\n1. CVE-2024-1086:\nLinux kernel LPE PoC\nhttps://github.com/notselwyn/cve-2024-1086\n]-> https://pwning.tech/nftables\n\n2. CVE-2024-28085:\nWallEscape vulnerability in util-linux\nhttps://people.rit.edu/sjf5462/6831711781/wall_2_27_2024.txt\n]-> https://github.com/skyler-ferrante/CVE-2024-28085", "creation_timestamp": "2024-11-19T17:32:41.000000Z"}, {"uuid": "dbd6a471-d8b9-44c2-ae83-e652f0778b2a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/CyberSachok/1739", "content": "\u041a\u0430\u043a\u043e\u0432\u0430 \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e\u0441\u0442\u044c \u0442\u043e\u0433\u043e, \u0447\u0442\u043e \u0437\u0430 11 \u043b\u0435\u0442 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0434 \u043f\u0440\u0438\u043a\u0440\u044b\u0442\u0438\u0435\u043c \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0445\u0430\u043a\u0435\u0440\u044b \u0435\u0439 \u043d\u0438 \u0440\u0430\u0437\u0443 \u043d\u0435 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c? \n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c WallEscape \u0442\u0430 \u0441\u0430\u043c\u0430\u044f \u0434\u044b\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0431\u044b\u043b\u0430 \u0432\u043d\u0435 \u043f\u043e\u043b\u044f \u0437\u0440\u0435\u043d\u0438\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 11 \u043b\u0435\u0442. \u0418 \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u0435\u0439\u0447\u0430\u0441 \u0435\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0421\u043a\u0430\u0439\u043b\u0435\u0440 \u0424\u0435\u0440\u0440\u0430\u043d\u0442\u0435. \u041e\u043d \u043e\u043f\u0438\u0441\u0430\u043b CVE-2024-28085 \u043a\u0430\u043a \u00ab\u043d\u0435\u043f\u0440\u0430\u0432\u0438\u043b\u044c\u043d\u0443\u044e \u043d\u0435\u0439\u0442\u0440\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u044e \u043f\u043e\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c\u043d\u043e\u0441\u0442\u0435\u0439 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0432 \u043a\u043e\u043c\u0430\u043d\u0434\u0435 wall\u00bb.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430, \u0435\u0441\u043b\u0438 \u043a\u0440\u0430\u0442\u043a\u043e, \u043a\u0430\u0441\u0430\u0435\u0442\u0441\u044f \u043a\u043e\u043c\u0430\u043d\u0434\u044b wall \u0432 \u043f\u0430\u043a\u0435\u0442\u0435 util-linux(\u0447\u0430\u0441\u0442\u044c \u0432\u0441\u0435\u0445 \u0434\u0438\u0441\u0442\u0440\u0438\u0431\u0443\u0442\u0438\u0432\u043e\u0432 Linux \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 11 \u043b\u0435\u0442). \u0423\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0438 \u0435\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0432 \u043d\u043e\u0432\u043e\u0439 \u0432\u0435\u0440\u0441\u0438\u0438 util-linux 2.40. \n\n\u041e\u043d\u0430 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0443\u0431\u0435\u0434\u0438\u0442\u044c \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u0438\u0442\u044c \u0441\u0432\u043e\u0439 \u0430\u0434\u043c\u0438\u043d-\u043f\u0430\u0440\u043e\u043b\u044c. \n\n\u0424\u0435\u0440\u0440\u0430\u043d\u0442\u0435 \u043f\u043e\u043a\u0430\u0437\u0430\u043b PoC-\u043a\u043e\u0434 \u0434\u043b\u044f \u0434\u0435\u043c\u043e\u043d\u0441\u0442\u0440\u0430\u0446\u0438\u0438 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0438 \u043e\u043f\u0438\u0441\u0430\u043b \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043d\u0435\u0436\u0435\u043b\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u043c \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0430\u043c.  \n\n\u0422\u0435\u043c \u043d\u0435 \u043c\u0435\u043d\u0435\u0435 \u0434\u043b\u044f \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0442\u0440\u0435\u0431\u0443\u044e\u0442\u0441\u044f \u043e\u0441\u043e\u0431\u044b\u0435 \u0443\u0441\u043b\u043e\u0432\u0438\u044f, \u0447\u0442\u043e \u0441\u043d\u0438\u0436\u0430\u0435\u0442 \u0435\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u043d\u043e\u0441\u0442\u044c, \u043d\u043e \u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0440\u0438\u0441\u043a \u0434\u043b\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u0432 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0445 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439. \n\n@cybersachok", "creation_timestamp": "2024-03-29T20:41:27.000000Z"}, {"uuid": "b43a1282-ae5d-49d7-8cf1-4a6758e2a4ef", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "seen", "source": "https://t.me/TomCyberDaily/26", "content": "It's Friday, and it is also time for TomCyberDaily #9!\nGet comfortable, chug a shot of whiskey or a nonalcoholic drink, your choice. ;) \n\nSo let's go!\n1. Well, well, well, looks like Hot Topic got stuffed... with credential stuffing attacks, that is!\n\nHackers decided to play a game of \"guess the password\" with Hot Topic's website and app, and some customers' info ended up as the prize. Oops!\n\nBut don't worry, Hot Topic called in the cybersecurity Avengers to save the day with bot-blocking tech.\n\nThey also hit the reset button on passwords, because apparently, \"ilovemcr\" isn't as secure as you might think.\n\nThe best part? This isn't even Hot Topic's first credential stuffing rodeo. They're like the popular kid at hacker high.\n\n\n2. PyPI slams the brakes on new user registrations and projects. Why? Malware campaign crashed the party!\n\nHackers got creative, uploading 365+ packages with names that mimic legit ones. But surprise! They come with a side of malicious code.\n\nThe bad stuff hides using encryption and dynamic URLs, fetching more malware goodies. The final boss? An info-stealer targeting your browser data.\n\nCheck Point says it's over 500 packages, deployed by an army of unique maintainer accounts. Automation for the win!\n\n3. DinodasRAT, the backdoor that won't quit, has gone Linux! This sneaky malware is now targeting countries like a digital kleptomaniac.\n\nApparently, DinodasRAT has been quite the globetrotter, with previous sightings in Guyana and other government entities worldwide. It's like the James Bond of malware!\n\nKaspersky found the Linux version, which has a thing for Red Hat-based distros and Ubuntu. Once it moves in, it uses startup scripts and chats with a remote server for its evil plans.\n\nThis RAT is an overachiever, capable of file ops, process management, shell command execution, and even self-uninstallation. Talk about a malware Swiss Army knife!\n\nIt even uses the Tiny Encryption Algorithm to keep its communications hush-hush. Sneaky, sneaky!\n\n4. There's a sneaky 11-year-old bug in the Linux 'wall' command that lets attackers steal passwords and mess with your clipboard. It's like a digital pickpocket on steroids!\n\nTo exploit \"WallEscape\" (CVE-2024-28085), an attacker needs access to a Linux server with multiple users. It's like a hacker's version of a college dorm party gone wrong!\n\nThe problem? Bad filtering of escape sequences in command line arguments. It's like leaving the back door open for pranksters!\n\nProof-of-concept code shows how an attacker could create a fake SUDO prompt and trick users into typing their passwords. It's like falling for a phishing scam in your own terminal!\n\nBut wait, there's more! Attackers could also change your clipboard contents. It's like playing \"I'm not touching you\" with your copy-paste!\n\nThe fix? Upgrade to linux-utils v2.40 or remove setgid permissions from 'wall'. It's like putting a deadbolt on your digital door!", "creation_timestamp": "2026-07-16T03:00:04.112335Z"}, {"uuid": "9f92ae5f-88ce-4adc-868d-e673827027d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2024-28085", "type": "published-proof-of-concept", "source": "https://t.me/TomCyberDaily/26", "content": "It's Friday, and it is also time for TomCyberDaily #9!\nGet comfortable, chug a shot of whiskey or a nonalcoholic drink, your choice. ;) \n\nSo let's go!\n1. Well, well, well, looks like Hot Topic got stuffed... with credential stuffing attacks, that is!\n\nHackers decided to play a game of \"guess the password\" with Hot Topic's website and app, and some customers' info ended up as the prize. Oops!\n\nBut don't worry, Hot Topic called in the cybersecurity Avengers to save the day with bot-blocking tech.\n\nThey also hit the reset button on passwords, because apparently, \"ilovemcr\" isn't as secure as you might think.\n\nThe best part? This isn't even Hot Topic's first credential stuffing rodeo. They're like the popular kid at hacker high.\n\n\n2. PyPI slams the brakes on new user registrations and projects. Why? Malware campaign crashed the party!\n\nHackers got creative, uploading 365+ packages with names that mimic legit ones. But surprise! They come with a side of malicious code.\n\nThe bad stuff hides using encryption and dynamic URLs, fetching more malware goodies. The final boss? An info-stealer targeting your browser data.\n\nCheck Point says it's over 500 packages, deployed by an army of unique maintainer accounts. Automation for the win!\n\n3. DinodasRAT, the backdoor that won't quit, has gone Linux! This sneaky malware is now targeting countries like a digital kleptomaniac.\n\nApparently, DinodasRAT has been quite the globetrotter, with previous sightings in Guyana and other government entities worldwide. It's like the James Bond of malware!\n\nKaspersky found the Linux version, which has a thing for Red Hat-based distros and Ubuntu. Once it moves in, it uses startup scripts and chats with a remote server for its evil plans.\n\nThis RAT is an overachiever, capable of file ops, process management, shell command execution, and even self-uninstallation. Talk about a malware Swiss Army knife!\n\nIt even uses the Tiny Encryption Algorithm to keep its communications hush-hush. Sneaky, sneaky!\n\n4. There's a sneaky 11-year-old bug in the Linux 'wall' command that lets attackers steal passwords and mess with your clipboard. It's like a digital pickpocket on steroids!\n\nTo exploit \"WallEscape\" (CVE-2024-28085), an attacker needs access to a Linux server with multiple users. It's like a hacker's version of a college dorm party gone wrong!\n\nThe problem? Bad filtering of escape sequences in command line arguments. It's like leaving the back door open for pranksters!\n\nProof-of-concept code shows how an attacker could create a fake SUDO prompt and trick users into typing their passwords. It's like falling for a phishing scam in your own terminal!\n\nBut wait, there's more! Attackers could also change your clipboard contents. It's like playing \"I'm not touching you\" with your copy-paste!\n\nThe fix? Upgrade to linux-utils v2.40 or remove setgid permissions from 'wall'. It's like putting a deadbolt on your digital door!", "creation_timestamp": "2026-07-17T00:00:56.843813Z"}]}