How do I secure my shared folder

I have some problems:

  1. I use VMware Workstation 12 Player, I log on to the PC using domain admin, then I created some local users. With my domain admin, I have installed some applications, however, I try to log on to that PC using local user and I cannot see those applications. How do I configure in order local user can get those applications?
  2. I created a shared folder from guest OS to the host OS in order to gather information from guest OS to the host OS. however, it can easy for user to move data from host OS to the guest OS. How do I protect that shared folder in order to be more secured (data cannot be moved from host OS to the guest OS)?
  3. I use VMware Workstation 12 Player with 2 MAC addresses which are from guest OS and host OS. I use 2 port security (switchport port-security maximum 2) I can get internet connection with my domain admin, but I did not get internet connectivity (cannot reach IP gateway) with domain user. Further, when I changed maximum value of port security to be 7. My domain user can get the internet connection. Since security issue, I have to use maximum value of port security is 2. What do I have to do to get internet connection with 2 port security.
    For your information, I use Windows 7.

I look forward for any response or suggestion. Any suggestion would be appreciated. Thanks.

Related:

Metasploit db_status shows connected to msf but rebuild_cache shows not connected

I am not able to rebuild the db cache although db_status suggests i am connected to the database? Pls help.

msf > db_status

[*] postgresql connected to msf

msf > db_rebuild_cache

[-] The database is not connected

msf > search wordpress

[!] Module database cache not built yet, using slow search

msf > msfdb init

[*] exec: msfdb init
A database appears to be already configured, skipping initialization

Related:

Security, VPN access issues on TP-Link File Sharing [on hold]

If I attach a USB, or a Seagate drive to my router, here is some questions:

  • Does security is an issue to TP-Link router file sharing? is it better on security to monitor files on a file server (Computer)?
    • And is there any method for user to remote access the file sharing from the outside of the LAN? like from internet. Using VPN?

Related:

Give a Windows 2008 VM Internet access but block Host LAN access?

Securing a guest VM to give it internet access, but block access to host LAN

The above was a similar question asked for Linux but the following has specifics that are different.

We need to have this VM (clone from a key server/ DC) Updated (via the Internet) to test something but not allow this clone to access the Host LAN & other machines.

The VM is Windows SBS 2008 and is on a Test Box running Win 2012 R2 with both: Hyper V and VMWare (being able to switch in between).

Currently it is inside VMWare Workstation 10.0 but we’ve also had a cloned one inside Hyper V as well.

So whichever way is easier to make this happen please do point out.

Related:

VU#865216: CodeLathe FileCloud is vulnerable to cross-site request forgery

Vulnerability Note VU#865216

CodeLathe FileCloud is vulnerable to cross-site request forgery

Original Release date: 13 Jan 2017 | Last revised: 13 Jan 2017

Overview

CodeLathe FileCloud, version 13.0.0.32841 and earlier, is vulnerable to cross-site request forgery (CSRF).

Description

CWE-352: Cross-Site Request Forgery (CSRF) – CVE-2016-6578

CodeLathe FileCloud is an "is an Enterprise File Access, Sync and Share solution that runs on-premise." FileCloud, version 13.0.0.32841 and earlier, contains a global cross-site request forgery (CSRF) vulnerability. An attacker can perform actions with the same permissions as a victim user, provided the victim has an active session and is induced to trigger the malicious request.

Impact

A remote, unauthenticated attacker may be able to induce an authenticated user into making an unintentional request to the FileCloud server that will be treated as an authentic request.

Solution

Apply an update

The vendor has released version 14.0 to address this vulnerability. Users are encouraged to view the release notes and update to the latest release.

Vendor Information (Learn More)

Vendor Status Date Notified Date Updated
CodeLathe Affected 16 Sep 2016 14 Dec 2016

If you are a vendor and your product is affected, let
us know
.

CVSS Metrics (Learn More)

Group Score Vector
Base 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P
Temporal 5.3 E:POC/RL:OF/RC:C
Environmental 4.0 CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

References

Credit

Thanks to Stéphane Adamiste for reporting this vulnerability.

This document was written by Joel Land.

Other Information

  • CVE IDs:
    CVE-2016-6578
  • Date Public:
    13 Jan 2017
  • Date First Published:
    13 Jan 2017
  • Date Last Updated:
    13 Jan 2017
  • Document Revision:
    7

Feedback

If you have feedback, comments, or additional information about this vulnerability, please send us email.

Related: