Datagram Transport Layer Security

So, uh, so that you could, like, have a malicious server fool the client.

And some of them are against the DTLS, which in short is, uh, TLS over UDP, and that means that application data may be lost.

Um, and, uh, this is a requirement area where we put less effort.

It was, uh, somebody that, uh, wanted it, but then they dropped requirement.

The manager receives traps and informs on port 162.

And with TLS or DTLS wrapping it, ports 161 and W62.

Why UDP? That's a real choice.

Because it's cheap.

Never forget.

So anyways, the vulnerability itself takes place in how the Citrix NetScaler appliance handles DTLS fragmentation.

So DTLS, it's the way to add encryption to UDP packets.

There's a bit of a handshake that's kind of different than how you would do it over a TCP-based connection.

But it supports fragmenting packets, meaning you can send a larger piece of data over multiple smaller packets.

We can hit these really quick.

Watchtower analyzed that pre-auth DTLS memory overflow.

Turns out DTLS is TLS over UDP.

Weird.

Okay.

So like if you're running that version, you're vulnerable.

And the rest of them require that a feature be enabled.

The DTLS is actually enabled if you're using the VPN functionality on it.

It fires during the first handshake before any login and hands over route.

DTLS is on by default for gateway VPNs, so patch now and hunt for the Blipshot and Sloughchip web shells.

Two flaws in Amazon Bedrock Agent Core's Python kit led a crafted package named smuggle-shell-commands into its code interpreter sandbox, exposing the sandbox's temporary AWS credentials.

The awkward part? AWS's first fix was bypassed too.

One weakness allows unauthenticated code execution in default deployments.

The other affects systems with DTLS enabled.

CISA added both to its known exploited vulnerabilities catalog, and more than 20,000 internet-exposed instances were reported as potentially at risk.

Confirmed compromises were not described as widespread.