vulnerability

How can be vulnerability be an advantage to a person?Everyone is vulnerable. No matter how big you are or how strong you are we are all capable of getting hurt. Everyday of our lives we face challenges wherein at the end of the day we feel wounded.However this does not sop us from overcoming the struggles we face. For 21 years I never thought of the word vulnerable.But recently this word came in m

For all the exaggerations about the number of people who downloaded 3 Mozilla’s Firefox open source browser on a five-hour, now there is exaggeration about how long it takes security researchers to disclose a flaw. Five hours after Mozilla officially released the long-awaited update, turning point confirmed a vulnerability. Point of inflection of the Zero Day [...]

Firefox 3 is now officially the most downloaded software in 24 hours. And since Tuesday, it has received over 12 million downloads. Firefox is the world’s most secure browser, but its first critical vulnerability was found just after 5 hours of its release. Even after working for so many months on this browser, it looks [...]

Firefox 3, One of the Maximum Downloaded Open Source browser has just finished up with its World Record Download Day and here is one more big news about a possible Critical Vulnerability in Firefox 3 Devlabs from Tippingpoint has reported a critical vulnerability with high severity affecting Firefox 3 and prior versions of Firefox 2.0.x. on [...]

Zero Day Initiative’s Upcoming Advisories reported a critical vulnerability to newly released Mozilla Firefox 3.0 (ZDI-CAN-349).  According to TippingPoint’s DVLabs blog post —[…]this Firefox 3.0 vulnerability, also affects prior versions of Firefox 2.0.x, and it has been tested and reported to the Mozilla security team. While Mo

A little over a week ago, I wrote about a security advisory from Microsoft warning that Apple’s Safari Web browser for Windows introduces new vulnerabilities. Specifically, Microsoft said it allows automatic downloading of files to the Windows desktop, files that in some cases could be run without the user’s knowledge. Over the weekend, [...]

Microsoft is investigating new public reports of a blended threat that allows remote code execution on all supported versions of Windows XP and Windows Vista when Apple’s Safari for Windows has been installed. Safari is not installed with Windows XP or Windows Vista by default; it must be installed independently or through the Apple Software Update application. Customers running Safari on Window

On April 8, 2008 Adobe released a Security Bulletin regarding vulnerabilities with various versions of Adobe Flash Player.  In the Security Bulletin they recommend upgrading to the latest version of Adobe Flash Player (at least to version 9.0.124.0 or higher).  However, various reports were published today from security firms and security related websites reminding users about the

In the past few months, Americans have seen a plethora of extreme weather ranging from extreme droughts in the south, tornado’s in the Midwest and unprecedented flooding in America’s heartland. Although we’ve all seen the disastrous affects of Mother Nature venting her rage over the course of our lives, at no time in recorded [...]

DescriptionCognitive Vulnerability to Emotional Disorders Publisher: Lawrence Erlbaum AssociatesNumber Of Pages: 464Publication Date: 2005-08-16Sales Rank: 989294ISBN / ASIN: 0805857745EAN: 9780805857740Binding: PaperbackManufacturer: Lawrence Erlbaum AssociatesStudio: Lawrence Erlbaum AssociatesEmotional disorders such as anxiety, depression, and dysfunctional patterns of eating are clearly among

BitDefender informed that it had addressed the critical  zero-day security flaw of Internet Explorer 7 and Internet Explorer 8 Beta 1 by issuing a signature update for its products. The Cross-Zone Scripting vulnerability in the browser’s “Print Table of Links” feature was discovered by independent security researcher Aviv Raff, who also made public the attack code [...]

Ask any CIO or CTO the number one concern or risk in implementing Software as a Service (SaaS) or Enterprise on-demand system, and they will most likely tell you security. Here is a good view last week from White Hat Security that explains people live in a false sense of security (no pun intended) when it [...]

Protector Plus - Windows Vulnerability Scanner checks your system for Windows Vulnerabilities. It guides you to update with the right patch to make your system secure. This program is updated regularly by Proland Software to detect all the vulnerabilities discovered. This software is compatible with Windows XP (Home & Professional), Windows 2000 Server & Professional and [...]

Sen. Obama in Oregon Saturday, according to CBS: If George Bush and John McCain have a problem with direct diplomacy, led by the President of the United States, then they can explain why they have a problem with John F. Kennedy, because that’s what he did with Khrushchev, or Ronald Reagan, because that’s what he did [...]

An OpenSSL key vulnerability for Debian 4.0 and Debian-based Linux distributions was published on May 13th, 2008. This vulnerability has the potential to affect any systems which trust keys generated by Debian 4.0 and its derivative operating systems. Please see the Debian and Debian-based Distribution Security Notice posted on the VPSLink forums and the SSL [...]

After investigating public reports, Microsoft has published Microsoft Security Advisory 951306, which describes a vulnerability that affects multiple versions of Windows (including Windows XP Professional Service Pack 2, all supported versions and editions of Windows Server 2003, Windows Vista, Windows Vista Service Pack 1, and Windows Server 2008.) The newly found security flaw could potentially allow a malicious local [...]

日防夜防，家賊難防。這句諺語您應該耳熟能詳吧？這也很適合用來描述Windows的作業系統，現代人的電腦中幾乎都裝有防毒系統，在更多者甚至有防火牆、掃木馬等等安全軟體；但您知道這些軟體都無法擋住作業系統本身的漏洞嗎？而本軟體就是針對OS本身的漏洞加以掃描偵查，可以讓您早日針對問題修補、也就是像打了預防針。特別的是該工具還提供Protector Plus for Windows（作業系統防護外掛），以完整保護您的系統。 【網站網址】 相關文章 ESET SysInspector - NOD32公司推出的免費系統安全分析服務 TrueTransparency - 讓視窗邊框透明化 Active Lock - 把隨身碟當做電腦的鑰匙 把磁碟容量畫圖給你看 - WinDirSta

Late on Thursday Microsoft released an advisory about a new privilege escalation vulnerability affecting IIS and SQL Server on Windows XP, 2003, Vista, and Server 2008. It’s likely that this is the... [[ This is a content summary only. Visit my website for full links, other content, and more! ]]

Protector Plus is a free and useful application for Windows that checks your system for Windows vulnerabilities. Windows operating system have vulnerabilities and these can be exploited by malicious programs, hackers to steal or harm your critical data. The only solution is to update your system by using Windows updates. But you don’t get a good description of what the vulnerability is in windows update so you won’t have much of an idea what you are installing.Protector Plus making this processes easier. It scans your PC for Windows Vulnerabilities and lists the vulnerabilities detected, their risk level and the download location of the patch. It guides you to update with the right patch to make your system secure.This is a small application from Porland Software and is available for f

Now, normally when I find an XSS vulnerability on a popular domain I just report it to the appropriate security team and move on, but this one is interesting…By taking advantage of the content-type returned by spreadsheets.google.com (and a caching flaw on the part of Google), I was able to pull off a full blown XSS against the google.com domain. For those of you who don’t understand what this means, allow me to elaborate. When Google sets their cookie, it is valid for all of their sub domains. So, when you log into gmail (mail.google.com), your gmail cookie is actually valid for code.google.com, docs.google.com, spreadsheets.google.com…and so on. If someone (like me) finds an XSS vulnerability in any one of these sub domains, I’ll be able to hijack your session and access any g

It is the type of vulnerability that Microsoft wanted to head off as long as possible, especially since Windows Vista’s new kernel was designed to thwart this possibility. Now, as the company acknowledged in a security bulletin yesterday, a malicious program running as a local or network service can leverage another local or network service running [...]

Microsoft is investigating new public reports of a vulnerability which could allow elevation of privilege from authenticated user to LocalSystem, affecting Windows XP Professional Service Pack 2 and all supported versions and editions of Windows Server 2003, Windows Vista, and Windows Server 2008. Customers who allow user-provided code to run in an authenticated context, such [...]

The report that has been issued compiling the first year’s worth of security vulnerability’s found in Windows Vista, and comparing Windows  XP and non-Microsoft OS’s first year vulnerabilities. Here are a few highlights : Metric Windows Vista (year 1) Windows XP (year 1) Vulnerabilities fixed 36 65 Security Updates 17 30 Patch Events 9 26 Weeks with [...]

The third and final service pack for Windows XP is not even out, and Microsoft is already hammering away at it plugging security soles. Although it debuted in full development alongside Windows Vista SP1, Windows XP Service Pack 3 is yet to be finalized with the delivery planned by mid-2008. Since the end of [...]

Norton antivirus is one of the most trusted antivirs programs that many computer users use to protect them from various vulnerabilities like virus programs, mailware and many other vulnerabilities, but what if the antivirus program latest patches contain the vulnerabilities that can harm your computer system. This is what several people found that thses [...]

Is there such a thing as safety and security? A child relies on a security blanket to make the child feel safe, but every adult knows the blanket can do nothing to protect the child. Is any other thing we look to for security any different? What is it we are worried about? Website - Directly to RSS feed of podcast - Namaste, ~ Eric Putkonen

As reported earlier on today about the PS3 Vulnerability and Network Hack which left weaknesses found on their PSN system (See Here), Sony have officially said sorry. Sony officially Apologizes for the PS3 Vulnerability and Network Hack, we deserve more than just an apology because this should never have happened. Hackers who discovered a way to hack [...]

"Details are still sparse (and primarily in Japanese), but our Tokyo bureau just let us know that Sony's announced a fairly severe security vulnerability on the PlayStation Network, which would actually allow an attacker to access your account, personal information, and Wallet -- but not your credit card on file -- as well as change your password."[via engadget]

The latest attacks targeting vulnerabilities in Microsoft's software products have steered clear of Windows Vista Service Pack 1. And despite the fact that the Redmond company touted security advancements when it introduced SP1 for Vista, available as of March 18, the fact of the matter is that neither Windows Vista RTM is impacted by exploits targeting a buffer overrun vulnerability in the

MS Word subjected to selective attacks. Microsoft confirms Word attacks Microsoft has confirmed reports of vulnerability in Word that allows an attacker to exploit a system via the Microsoft Jet Database Engine, which shares data with Access, Visual Basic and third party applications. Microsoft in its advisory said the potential for attack is “very limited.” Reports of the Word flaw were

I usually do not blog on Advisories we release as I guess that you subscribed to the corresponding alerts. If not, you should do that now here. This one is a little bit different as I know that quite some people within Microsoft are working during Easter because of this vulnerability. Therefore I want to make sure that you have seen it. Please read the Advisory called Vulnerability in Microsoft Jet Database Engine (Jet) Could Allow Remote Code Execution and make sure you do your proper risk assessment Roger

I was going to use a WP-Uploads option for uploading pictures. This allows you to have a much easier time uploading pictures and linking to it on your blog posts. What I discovered was that you have to change the file permissions to 777 of the content folder, in order for wordpress to [...]

Apple had more than 5 times the number of flaws per month than Windows XP and Vista in 2007, and most of these flaws are serious. Clearly this goes against conventional wisdom because the numbers show just the opposite and it isn’t even close.

What was not supposed to happen in Windows Vista apparently has: Despite a layer of protection that was supposed to prevent against processes elevating their own privileges, Microsoft now says someone found a way to do it.A Microsoft security bulletin written earlier this week but publicized this morning cites security software engineers SkyRecon Systems as having discovered a way for processes in both 32- and 64-bit versions of Windows Vista to elevate their own privilege to administrator level.This discovery would likely be the latest in several months to thwart the designs of PatchGuard, Microsoft's series of measures for innovating the design of the operating system kernel in the interest of thwarting the most common attacks that plagued Windows XP. Last February, PatchGuard was theoretically defeated, using methodology made public by, ironically, Symantec.Precise details of this latest vulnerability have not been released by either Microsoft or SkyRecon, most likely to protect th

Summer Academy on Social Vulnerability 2008 - Call for Applications The UNU-EHS Chair on Social Vulnerability, supported by MunichRe Foundation, organises for the 3rd time the Summer Academy. The academy, taking place from 20-26 July 2008 at the historic Hohenkammer Castle (Schloss Hohenkammer) in the countryside outside of Munich, Germany is entitled “Environmental Change, Migration, & Social Vulnerability”. Once again, we are happy to be able to offer 20 places for qualified PhD candidates working on dissertations related to environmental change, migration and social vulnerability. We accept applications for the 2008 Summer Academy until 15 January 2008. Please apply online only by clicking on the provided link “apply now”. Note: Saya pernah ikut Summer Academy ini tahun 2007 dan benar-benar mendapatkan manfaat yang besar dalam sharing riset tentang disaster management, vulnerability, risk, etc. From: www.ehs.unu.edu

La revista "SC Magazine" publico este año una evaluación de distintos productos especializados en el análisis de vulnerabilidades, para los que les gusta ver las virtudes y comentarios les recomendamos darle una lectura al articulo "Vulnerability assessment 2007" (Ingles) This month we looked at vulnerability assessment and penetration test tools. The leading difference between last year’s tests

Last week I had the opportunity to spend two days on a rustic team building retreat at Joy Outdoor Education Center in Clarksville, Ohio, courtesy of a corporate client, Hill-Rom, where the group learned about their Insights® colors (courtesy of Scott Schwefel), did a high ropes course and related activities, endured gusts up to 34 mph and wind chills down to the teens (brrr!), shared emotionally-moving and personal stories deep into the night by light (and warmth) of a bonfire, slept in cabins, ate camp food, and stretched and grew in ways that were truly amazing. And that was Day One!Day Two included a morning of coaching and facilitation, courtesy of yours truly, and an afternoon of detailed departmental planning and goal-setting, led by Phillip Saxton, president of MiTowne.Initially, I perceived, and prepared for, my role as that of catalyst: "an agent that provokes or speeds significant change or action," as Merriam Webster might say. But as I settled into my bunk that first nigh

InfoWorld 6/11/2007Website: http://www.infoworld.com San Francisco (IDGNS) - Microsoft has warned that a faulty driver used for copy protection could allow a hacker to gain high-level access to a PC.The problem lies with a driver called secdrv.sys, which is part Macrovision's SafeDisc software included with Windows Server 2003 and Windows XP. The software, which can block unauthorized copying of some media, also ships with Windows Vista, but that OS is not affected. Microsoft said it knows of "limited attacks" that try to use the vulnerability, in an attack known as an elevation of privilege. The vulnerability could allow a hacker with local access to a machine to elevate his access rights and gain administrator rights, for example, allowing him to install software. Microsoft said it was concerned that the vulnerability had been disclosed before it had a chance to fix it, which puts people at greater risk. "We continue to encourage responsible disclosure of

Secunia.com 2007-11-01 , release at their website a vulnerability has been reported in Novell BorderManager, which can be exploited by malicious people to compromise a vulnerable system.The vulnerability is caused due to the Client Trust application incorrectly processing validation requests sent to the UDP port on which clntrust.exe is listening (by default 3024). This can be exploited to cause a heap-based buffer overflow by sending a specially crafted validation request containing a Novell tree name without backslash or zero wide characters.Successful exploitation allows execution of arbitrary code.The vulnerability is reported in Novell BorderManager 3.8. Prior versions may also be affected.Solution : Download patch from Vendor (http://download.novell.com/Download?buildid=AuOWp2Xsvmc~)6 Related Secunia Security Advisories 1. Novell BorderManager Unicode Encoding Detection Bypass2. Novell BorderManager ISAKMP Predictable Cookie Security Issue3. Novell BorderManager VPN Denial of Ser

The vulnerability affects Adobe Reader 8.1 and earlier, Adobe Reader 7.0.9 and earlier, and a handful of Adobe Acrobat Professional versions. By Thomas Claburn InformationWeek Adobe (NSDQ: ADBE) on Monday released an update to fix a critical vulnerability its Reader and Acrobat software that could affect people running Microsoft (NSDQ: MSFT) Windows XP and Internet Explorer 7. The vulnerability could allow an attacker to take control of the computer running the affected Adobe software. It was first disclosed September 20th and confirmed by Adobe on October 5th. “A malicious file must be loaded in Adobe Reader or Acrobat by the end user for an attacker to exploit these vulnerabilities,” Adobe said. “This issue is remotely exploitable.” (more…)

More Vulnerabilities Found; More Platforms Affected Severity: High 26 October, 2007 Update: On Monday 22 October, we published an alert about a serious vulnerability that affects RealPlayer 10.5 and RealPlayer 11 beta running on Windows. By enticing one of your users to a malicious Web site, an attacker can exploit this vulnerability to execute code on your user’s computer, with your user’s privileges. In the worst case scenario, the attacker could gain total control of the victim’s PC. RealNetworks released a patch to fix that problem. However, it appears that update marked just the beginning of RealNetwork security holes. Late yesterday, RealNetwork released the second batch of security updates this week, this time fixing six serious vulnerabilities in their media player product line. Here’s what you need to know about the new flaws. The new flaws affect many more products than the earlier flaw did, including products that run in OS X and Linux. The affecte

News Factor Network 24/10/2007Website: http://www.newsfactor.comAdobe patched its Acrobat and Reader programs on Monday. The fix plugs a hole that exposed Windows XP users to attackers sending PDF files containing malware. According to various reports, exploits are running rampant around the Internet in search of unpatched applications."Critical vulnerabilities have been identified in Adobe Reader and Acrobat that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system," Adobe said in a security bulletin. "A malicious file must be loaded in Adobe Reader or Acrobat by the end user for an attacker to exploit these vulnerabilities."Windows XP users who also run Internet Explorer 7 are at risk. Adobe first admitted to the bug about two weeks ago and posted a complex workaround that required users to edit the Windows registry. The flaw was first discovered on September 20 by "pdp" on the Gnucitizen Web site.Anatomy of the AttackAttacke

Liberation, Freedom, and Enlightenment – by its very nature – is an opening. It is a removing of walls and cords of attachment that restrict and confine, but also a removing of the shells and defenses used to protect the “little me.” As we open, often there is a feeling of vulnerability and then fear – as we have been shown and taught to protect ourselves and that it is a dangerous world. We are taught not to trust people…that trust must be earned. Until it is earned, keep those walls and barricades up. What I suggest is demolition…embracing vulnerability. Immediately the question may come to mind…what if I am hurt. My answer is that it is a certainty at some point you will be hurt. Accept it. Be willing to be hurt. If you open up and trust all – whether earned or not – you will be betrayed and hurt at some point…given enough time. But I find it is a small minority that will betray you. Would you close yourself off from a 100 because the 1 betrays

A vulnerability has been reported in Asterisk, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially to compromise a vulnerable system.The vulnerability is caused due to a boundary error within the IMAP-specific code for processing voicemail messages. This can be exploited to cause a buffer overflow via a specially crafted voicemail message sent as email containing an overly long (more than 1024 characters) combination of Content-Type or Content-Description headers.Successful exploitation requires that a user listens to the voicemail message via a phone. The vulnerability is reported in 1.4.x versions prior to 1.4.13.Secunia ReportAsterisk Report and SolutionTags: Denial of Service, Asterisk, Secunia, Asterisk Security, IMAP, VoIP Security

Reversing its initial assessment, Microsoft on Wednesday acknowledged that it needs to fix a vulnerability in its Internet Explorer 7 Web browser that could allow malicious Web sites to install unwanted software on Windows XP and Windows Server 2003 machines. Evidence of the flaw first surfaced in June, and not long after Firefox [...]

A post on LXer suggests that a Microsoft vulnerability report shows that Microsoft wasn't able to fix more Windows flaws than the number of open software flaws fixed by the major open source companies. It continues to say that: "Red Hat, having forty times less employees than Microsoft, did the best job, by fixing and closing the most security bugs, also closing even minor bugs - where Microsoft

A post on LXer suggests that a Microsoft vulnerability report shows that Microsoft wasn't able to fix more Windows flaws than the number of open software flaws fixed by the major open source companies. It continues to say that: "Red Hat, having forty times less employees than Microsoft, did the best job, by fixing and closing the most security bugs, also closing even minor bugs - where Microsoft

from ComputerWorld UK 25/9/2007Website: http://www.computerworlduk.comGoogle's Gmail can be easily hacked, allowing any past and future emails to read by hackers, according to a vulnerability researcher.A "cross-site request forgery" (CSRF) bug was disclosed by Petko Petkov, a UK-based web vulnerability tester who has made a name for himself of late. In the past two weeks, Petkov has publicly posted information about critical, zero-day bugs in Apple's QuickTime, Microsoft's Windows Media Player and Adobe's Portable Document Format (PDF).According to Petkov, who declined to release details about the vulnerability, attackers can use Gmail's filtering feature to exploit the bug. An attack, he said, would start with a victim visiting a malicious website while also still logged into his Gmail account. The malicious site would then perform what Petkov called a "multi-part/form-date POST" - an HTML command that can be used to upload files - to one of the Gmail application programming int

If any relationship is to proceed beyond the point of acquaintance, there needs to be a moment which one of the persons risks making themselves vulnerable . This is the place a friendship will develop , proceed and deepen, stay the same, or fall apart. If the other person accepts the “risk offering” and is supportive regardless of the “insecurities”, then the relationship begins its movement towards a friendship. The other person will hopefully, reciprocate and share some of their vulnerabilities and the bonds of trust will strengthen. This all depends if the person taking the risk has enough trust to take the first step toward the other and “expose” some of their defenses. In a previous essay, I suggested the first perception about the world comes from the first few days of life. If the infant gets the notion that the world is not a trust-able place, then all future perceptions will be filtered through it . Much of his/her

Severity: Medium 30 August, 2007 Summary: Late yesterday, Yahoo released an update that fixes a security vulnerability affecting any version of Yahoo! Messenger installed before August 29, 2007. By enticing a Yahoo! Messenger user into visiting a malicious Web page, an attacker can exploit this new flaw to execute code on that user’s computer, and possibly gain full control of it. If you use Yahoo! Messenger in your network, or suspect that your users have installed it, either remove it or install the latest version. Exposure: Yahoo! Messenger is one of the many Instant Messaging applications that allow users to send real-time, pop-up messages to each other over the Internet. Instant Messaging is popular enough that your users might have installed the Yahoo! Messenger client on a company computer whether or not your policy authorizes it. Yesterday, Yahoo released an advisory describing a buffer overflow vulnerability in an ActiveX control that ships with all previous versions of

An eavesdropping vulnerability was revealed on the popularFull Disclosure mailing list on Wednesday. Vulnerabilityresearchers Humberto Abdelnur, Radu State and Olivier Festorclaimed the exploit could allow a remote attacker to turn aVoIP phone into an eavesdropping device, citing a GrandstreamSIP phone as an example.While playing with the SIP Madynes stateful fuzzerfor a description see http://hal.inria.fr/inria-00166947/en),we have realized that some SIP stack engines have seriousbugs allowing to an attacker to automatically make a remotephone accept the call without ringing and without asking theuser to take the phone from the hook, such that the attackermight be able to listen to all conversations that take placein the remote room without being noticed.One example that wecan disclose (vendor was notified on 10 th May 2007) is thefollowing: Grandstream SIP Phone GXV-3000MADYNES Security Advisory : SIP remote attack onGrandstream SIP Phone GXV-3000Date of Discovery 7 th May, 2007

Спалю-ка я небольшую темку, как поиметь бэклинки с XSS-уязвимых сайтов.Вообще, XSS багов у меня уже вагон и маленькая тележка. Есть даже одна у Темы :).Ну, к делу.Ищем в любимом гугле intext:"PHP Version" intitle:"phpinfo()"И добавляем к найденым сайтам параметр ?f[]=%3Ca%20href%3Dhttp%3A//сайт%3Eанкор%3C/a%3EНапример, так.Проскрольте до блока Php Variables, там будут активные линки на ваш сайт.Все.

A vulnerability has been identified in Opera, which could be exploited by remote attackers to take complete control of an affected system. This issue is caused by an error when parsing specially crafted JavaScript data resulting in a virtual function call on an invalid pointer, which could be exploited by remote attackers to execute arbitrary commands by tricking a user into visiting a specially crafted web page.Affected ProductsOpera versions prior to 9.23SolutionUpgrade to Opera version 9.23 :http://www.opera.com/download/

A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.The vulnerability is caused due to an input validation error within the handling of system default URIs with registered URI handlers (e.g. "mailto", "news", "nntp", "snews", "telnet"). This can be exploited to execute arbitrary commands when a user e.g. using Firefox visits a malicious website with a specially crafted "mailto" URI containing a "%" character and ends in a certain extension (e.g. ".bat", ".cmd")Examples:mailto:test%../../../../windows/system32/calc.exe".cmdnntp:../../../../../Windows/system32/telnet.exe" "secunia.com 80%.batSuccessful exploitation requires that Internet Explorer 7 is installed on the system.The vulnerability is confirmed on a fully patched Windows XP SP2 and Windows Server 2003 SP2 system using Firefox version 2.0.0.5 and Netscape Navigator version 9.0b2. Other versions and browsers may also be affected.Solution:Do not br

The ripples from the problematic way special URLs are handled, discovered last week, continue to spread. Research by heise Security showed that as well as Firefox, other applications like Skype or Miranda can act as a gateway for the problem. This strongly suggests that the actual cause of the problem is the confusing way in which Windows handles URLs. If a program considers that it is not responsible for dealing with a URL type such as mailto:, it passes such URLs to the operating system to be dealt with further. Under Windows XP, however, what then happens depends on whether or not Internet Explorer 7 is installed (even if IE has nothing to do with the protocol in question). (more…) Share This

OPEN SOURCE VULNERABILITY DATABASE (OSVDB)OSVDB es una base de datos abierta e independiente de vulnerabilidades. Tiene como meta proporcionar información técnica, detallada, actual e imparcial de diversas plataformas y aplicacionesEste proyecto Open Source promueve la colaboración abierta entre las compañías y los individuos, busca eliminar trabajos redundantes, y reducirá los costos inherentes con el desarrollo y el mantenimiento de las bases de datos internas de la vulnerabilidades.El sitio oficial: http://www.osvdb.org/ ofrece la posibilidad de realizar búsquedas con distintos filtros en la base de datos:Vulnerability TitleDisclosure Date RangeReferenceTextVendorProductVersionVulnerability Classification:· Location: Physical, Local, Remote, Telephony and Unknown.· Attack Type: Authentication, Cryptographic, Denial Of Service, Hijacking, Information Disclosure, Infrastructure, Input Manipulation, Misconfiguration, Race Condition, Other and Unknown.· Impact: Loss of Confide

Very important, The last version of Firefox 2.0.0.5 contains a vulnerability in the password administration that allows malicious websites to steal your password. If you have Javascript enabled and let firefox to remember your passwords, you’re in danger. Mozilla’s team fixed a similar problem in November, one that didn’t require Javascript. However, Heise Security launched a site to let you check if you are vulnerable or not to this problem. My recommendations are: Use NoScript. Visit known websites until the problem is fixed Don’t ever try to use the option to remember your password in Firefox Just a note, Safari users has this same problem with their browser. critical, firefox, javascript, noscript, password, vulnerabilityShare This

Last week, a number of news outlets spotlighted a Swiss Internet start-up — curiously named “WabiSabiLabii” (pronounced “wobby-sobby-lobby”) — that is trying to establish an eBay-style auction site for software security vulnerabilities. I held off in covering this important story because I wanted to gauge the level of interest from members of the [...]

Rootkit.com said local vulnerability in Kaspersky Antivirus, which allows complete computer crash. According to the Rootkit.com all attempts to notify the Kaspersky Laboratory were unsuccessful. The vulnerability was discovered Ms-Rem few years ago for the older version of Kaspersky Antivirus, last summer was published exploits for Kaspersky AV 6.0, and now confirmed vulnerability to Kaspersky Antivirus 7.0. The vulnerability is caused by a problem with incorrect call NtOpenProcess parameters.  This feature is called the driver klif.sys for Kaspersky AV protection from unauthorized access. The site Kaspersky Antivirus, vulnerability author has not tried to contact the developers and published details before a correction. It also reported that the vulnerability can be used to execute arbitrary code, and leads only to restart the computer. Correction to discovered vulnerabilities will be released shortly and will be installed automatically to users.

Después de que ayer se publicara acerca de la Vulnerabilidad de KAS 7.0 Kaspersky Lab reacciono diciendo que no fueron notificados a tiempo con todo y que la vulnerabilidad tenia un año o mas he aquí lo que Kaspersky respondió hoyEl enlace original en inglesUn consultor (EP_X0FF), recientemente ha publicado en rootkit.com acerca de una vulnerabilidad en KAV 7.0. Desafortunadamente el autor de este material no se ha apegado a la practica estándar de la industria, de contactar a la empresa desarrolladora antes de divulgar los detalles de la vulnerabilidad. Aunque el autor afirma que todos los intentos de informar a Kaspersky Lab acerca de esta vulnerabilidad, fueron ignorados, este no ha sido el caso: Si hubiéramos sido informados, este hecho hubiera sido resuelto desde mucho tiempo atrás.Los siguientes productos son vulnerables:Kaspersky Internet Security 6.0/7.0Kaspersky Anti-Virus 6.0/7.0Kaspersky Anti-Virus for Windows Workstations 6.0Kaspersky Anti-Virus 6.0 for Windows Serv

Escanea y detecta las vulnerabilidades de tu WindowsMicrosoft de vez en cuando, lanza una serie de parches para solucionar las vulnerabilidades encontradas en sus sistemas operativos.A veces te pide instalarlas mientras se apaga la computadora o debes instalarlas manualmente.Windows Vulnerability Scanner 1.10, escanea y detecta todas las vulnerabilidades de tu Windows.Además ofrece un link hacie la parche de seguridad para solucionar este problema, con tan sólo hacer click en el nombre del parche.No necesitas instalarlo, sólo copiarlo en el disco duro y ejecutarlo cuando quieras.Sólo detecta en Windows 2000, Windows XP y Windows 2003 Servers.[Descargar Windows Vulnerability Scanner 1.10]

High Vulnerabilities: ACP3 — ACP3 Advanced Guestbook — Advanced Guestbook Agner Fog — aForum american cart — american cart Asterisk — Asterisk BarCodeWiz — BarCode ActiveX Control Berylium — Berylium2 Computer Associates — eTrust Integrated Threat Management Computer Associates — eTrust PestPatrol Computer Associates — eTrust EZ Antivirus Computer Associates — eTrust Integrated [...]

Microsoft Security Bulletin MS07-025 - Vulnerability in Microsoft Office Could Allow Remote Code Execution (934873) This update resolves a privately reported vulnerability. The vulnerability is documented in its own subsection in the Vulnerability Details section of this bulletin. An attacker who successfully exploited this vulnerability could take complete control of an affected system. [...]

Microsoft Security Bulletin MS07-029 - Vulnerability in RPC on Windows DNS Server Could Allow Remote Code Execution (935966) This update resolves a publicly disclosed vulnerability. The vulnerability is documented in its own subsection in the Vulnerability Details section of this bulletin. An attacker who successfully exploited this vulnerability could take complete control of [...]

Microsoft Security Bulletin MS07-027 - Cumulative Security Update for Internet Explorer (931768) Vulnerability This update resolves several newly discovered, privately reported and public vulnerabilities. Each vulnerability is documented in its own subsection in the Vulnerability Details section of this bulletin. If a user is logged on with administrative user rights, an attacker who [...]

High Vulnerabilities : Adobe — Photoshop Adobe — Photoshop Elements AFFLIB — AFFLIB Ahhp-Portal — Ahhp-Portal Ariadne — Ariadne CMS Aventail — Aventail Connect b2evolution — b2evolution Burak Yilmaz — Burak Yilmaz Blog Burnstone — BurnCMS Cerulean Studios — Trillian Pro Cisco — PIX Cisco — Adaptive Security Appliance CMS Made Simple — [...]

A vulnerability has been identified in Adobe Photoshop and Photoshop Elements, which could be exploited by attackers to cause a denial of service or execute arbitrary code. This issue is caused by a buffer overflow error when handling a malformed PNG image, which could be exploited by attackers to crash an affected application or compromise a vulnerable system by tricking a user into opening a malicious image. Affected Products Adobe Photoshop CS2 Adobe Photoshop CS3 Adobe Photoshop Elements version 5.0 and prior

High Vulnerabilities : ABC-View — ABC-View Manager ACDSee — ACDSee ACDSee — Photo Editor ACDSee — ACDSee Pro Adobe — Photoshop Advanced Webhost Billing System — Advanced Webhost Billing System AimStats — AimStats Alessandro Lulli — wavewoo Alexscriptengine — Download-Engine Antonio Da Cruz — Photofiltre Studio Apple — Mac OS X Server Apple [...]

Media Alert!VPN-1, UTM-1 and IPS-1 Automatically Defend Enterprises From New Buffer Overflow VulnerabilityREDWOOD CITY, Calif.- (BUSINESS WIRE) - Check Point® Software Technologies Ltd., the worldwide leader in securing the Internet, today announced that its firewall and intrusion prevention products, VPN-1, VPN-1 Power VSX, UTM-1, InterSpect and IPS-1, through Check Point SmartDefense subscription service, provide preemptive, zero day protection against a critical buffer overflow vulnerability.The CVE-2007-0038 vulnerability was announced in Microsoft Security Bulletin MS07-017 and affects Microsoft Windows 2000, XP, 2003 and Vista. It allows an attacker to create a buffer overflow and use it to inject and execute arbitrary code on the host machine, with full privileges of the victim user. To initiate this attack, the victim must be enticed to perform an action such as clicking an email link.With the NGX™ platform, Check Point is the only company to deliver a unified securit

Media Alert! VPN-1, UTM-1 and IPS-1 Automatically Defend Enterprises From New Buffer Overflow Vulnerability REDWOOD CITY, Calif.- (BUSINESS WIRE) - Check Point® Software Technologies Ltd., the worldwide leader in securing the Internet, today announced that its firewall and intrusion prevention products, VPN-1, VPN-1 Power VSX, UTM-1, InterSpect and IPS-1, through Check Point SmartDefense

It is often said that hackers eschew exploiting security holes in Apple’s Mac OS X operating system in favor of researching flaws in Microsoft Windows computers due to the fact that most of the world runs Microsoft machines. Thus, finding unpatched security flaws in Apple’s software simply doesn’t offer as much return on [...]

Multibyte character overflow issue breaches on-access defences. A vulnerability has been reported in the on-access component of McAfee’s flagship VirusScan product, which could be used to disable on-access protection and potentially to execute malicious code on a vulnerable system. The flaw involves a buffer overflow while processing files with exceptionally long filenames which include multibyte characters, [...]

High Vulnerabilities : ACD Systems — ACDSee Photo Manager AlstraSoft — Video Share Enterprise ArchiveXpert — ArchiveXpert CodeBreak — CodeBreak Cyboards — Cyboards PHP Lite Daniel Naber — LanguageTool DropAFew — DropAFew FastStone — Image Viewer Gazi Okul Sitesi — Gazi Okul Sitesi HIOX INDIA — Guest Book holaCMS — holaCMS HP — [...]

Jeremiah recently posted about the Microsoft Security Response Center inviting security researchers to disclose vulnerabilities discovered in a Microsoft “online web property,” which is to say, anything in the microsoft.com domain (or msn.com, live.com, etc.). Immediately, people started trying to profit from the idea, suggesting that Microsoft agree in advance to a “reward [...]

Microsoft confirmed yesterday that it has uncovered targeted attacks exploiting a new vulnerability in the Windows Server DNS Service. Microsoft immediately mobilised its Software Security Incident Response Process (SSIRP) to investigate. Due to a stack-based buffer overrun that exists in the Windows DNS Server’s remote procedure call (RPC) interface, attackers can send an [...]

Even if you have a firewall on your computer and your router has a firewall, it's still always a good idea to check using an external service which ports on your computer are open. You may not realized it, but your computer ports may be visible on the internet and that makes your computer a prime target for hackers and viruses. There are thousands of hackers out there that use automated port scanning software to find those poor computers with open ports! A good way to figure out which ports are open and how dangerous it is for your computer is to go to a site called Shield's Up! and use their vulnerability tool to have your computer scanned by their servers. Once you're at the web site, click Proceed to get started. On the next screen, you'll have the open to choose which type of scan you want like to perform: File Sharing ports, Common ports, All ports, Messenger spam, and browser headers. Go ahead and click on File Sharing to run that test and you should get something similiar t

The same day that various Office flaws were brought into the public light, yet another Windows vulnerability has been reported. This one could spell trouble, as it has the potential to cause code execution and ultimately system compromise. The problem, which McAfee reported, is in Windows help files. Currently, Microsoft’s advice is to [...]

We are currently investigating a possible exploit with MS, Active Directory, and DNS. At this point the information looks solid, provided initially by Bill O. for review. Further information has been provided by Bill, who is working on contacting MS, as things have progressed. Looking at the description of the attack method, it [...]

Microsoft has released Security Advisory 935423 “Vulnerability in Windows Animated Cursor Handling”. The vulnerability is currently being used in “drive-by” attacks where simply visiting a exploit web page or opening an email can compromise the computer. The exploit affects all recent versions of Windows (including Vista). This one is likely to go big [...]

Microsoft Corp. is investigating reports of a vulnerability in Vista’s Windows Mail. Reports have begun circulating online that the flaw could give a remote attacker access to the user’s computer. Windows Mail is an e-mail and newsgroup client that Microsoft built and dropped into its Windows Vista operating system. “Microsoft is not aware [...]

Just a few months after Vista’s official release, the first significant security problem has been uncovered: under certain circumstances, simply clicking on a link in an email can cause a program to be launched on the local computer. A hacker going by the pseudonym Kingcope has reported on a security mailing list that [...]

I saw first at the Debian Security website that the WordPerfect and StarCalc import libraries used by OpenOffice.org have some vulnerabilities for overflow attacks. Then is spread around the web in all security services. The flaw allows an attacker to execute arbitrary code. Affected are users that open WordPerfect documents, a rather small number of users. As far as I know, Word Perfect is used a lot by the legal profession. The work around, is to not open WordPerfect documents before you upgrade to the next version or install a patch. Debian and SuSE have already issued patches.