Just as a short notice: We just started to communicate that we will release a security update for the Internet Explorer vulnerability. At the moment, the update is schedule to be released approx 10:00 am PST (19:00 CET) tomorrow. Have a look at the Advanced Notification which you can find here: -dec.mspx Please start immediately with the preparation of the distribution of the update as well star
You know that I rarely blog on Advisories we publish unless they are heavily critical. I just want to make sure that you have seen this. MSRC (the Microsoft Security Response Center) constantly updates this advisory with workarounds. Please take this very, very serious: Microsoft Security Advisory (961051) Details on updates by MSRC Details from Security Vulnerability Research & De
Description: Emotional disorders such as anxiety, depression, and dysfunctional patterns of eating are clearly among the most devastating and prevalent confronting practitioners, and they have received much attention from researchers—in personality, social, cognitive, and developmental psychology, as well as in clinical psychology and psychiatry. A major recent focus has been cognitive vu
A remote code execution vulnerability has been reported in Microsoft XML Core Services (MSXML). MSXML is an application for processing Extensible Stylesheet Language Transformation in an XML file that allows programmers to create high-performance XML-based applications. By convincing a user to visit a specially crafted Web page, a remote attacker may trigger this vulnerability to execute arbitrary
A security researcher has today warned that a critical vulnerability in Google’s Android operating system could be used to hack their G1 smart phones.
A team from the Independent Security Evaluators have identified the bug and reported it to Google. The team is led by Charlie Miller, a researcher who has found high-profile bugs in Apple’s Mac OS X and the [...]
A security researcher has today warned that a critical vulnerability in Google’s Android operating system could be used to hack their G1 smart phones.
A team from the Independent Security Evaluators have identified the bug and reported it to Google. The team is led by Charlie Miller, a researcher who has found high-profile bugs in Apple’s Mac OS X and the [...]Post from: Tech Blog
You might know Jeff Jones' work on the different vulnerability reports comparing different products and vendors. Our goal is to understand and measure our progress and see where we stand with regards to the industry.
Today, Jeff release his OS Desktop vulnerability report for H1 2008, which shows to me some interesting results.
One is if you look at the Days of Risk – say on average after disc
On Thursday, October 23 2008, Microsoft released a critical out-of-cycle security update. This update addresses a vulnerability in the Windows server service that could allow remote code execution. Microsoft has rated this vulnerability Critical for all supported editions of Microsoft Windows 2000, Windows XP, and Windows Server 2003. This vulnerability has been rated Important for all supported
Our security team just published an excellent post with a lot more details on the vulnerability we patched. You should definitely read it: -detail-about-MS08-067.aspx
Roger
To reduce HIV/AIDS vulnerability among adolescents, there is a need to develop strategies and methods for effective curriculum focusing on sex education and life skills especially. Internalizing more participatory learning-teaching method, it is felt that a stronger integration of prevention education vis-à-vis sex & reproductive health approaches is essential for improving the high-quality HIV p
OpenVAS stands for Open Vulnerability Assessment System and is a network security scanner with associated tools like a graphical user front-end. The core component is a server with a set of network vulnerability tests (NVTs) to detect security problems in remote systems and applications.
About OpenVAS Server
The OpenVAS Server is the core application of the OpenVAS project. It is a scanner
On July 8, security researcher Dan Kaminsky announced he planned to reveal details about the DNS vulnerability (DNS cache poisoning) at Black Hat. Since then, many technology vendors have provided patches to help fix the flaw.
Kaminsky has provided a "DNS Checker" self test on his website - see his personal blog at
Link to Wall Street Journal article abo
On July 8, security researcher Dan Kaminsky announced he planned to reveal details about the DNS vulnerability (DNS cache poisoning) at Black Hat. Since then, many technology vendors have provided patches to help fix the flaw.
Kaminsky has provided a "DNS Checker" self test on his website - see his personal blog at
Link to Wall Street Journal article abo
Tipping Point has verified the bug and reported it to Mozilla, Tipping Point said on Wednesday.Since Mozilla is still working on a fix, the researchers won't share details about the problem. Tipping Point ranked the severity of the vulnerability as high, but said that users would have to click on a link in an e-mail or visit a malicious Web page before being affected. The issue affects users of Fi
Get all the Facts and See How to Implement a Successful Vulnerability Management Program.
As a business owner, or someone responsible for network security within your organization, you need to understand how to prevent attacks and eliminate network weaknesses that leave your business exposed and at risk.
Vulnerability Management for Dummies arms you with the facts and [...]
The iPhone’s Mail and Safari browser applications could leave owners to a URL spoofing vulnerability, which may allow attackers to conduct phishing attacks against the phone’s users.
By creating a specially crafted URL, and sending it via an e-mail, an attacker can convince the user that the spoofed URL, shown in the mail application, is from [...]
How can be vulnerability be an advantage to a person?Everyone is vulnerable. No matter how big you are or how strong you are we are all capable of getting hurt. Everyday of our lives we face challenges wherein at the end of the day we feel wounded.However this does not sop us from overcoming the struggles we face. For 21 years I never thought of the word vulnerable.But recently this word came in m
For all the exaggerations about the number of people who downloaded 3 Mozilla’s Firefox open source browser on a five-hour, now there is exaggeration about how long it takes security researchers to disclose a flaw.
Five hours after Mozilla officially released the long-awaited update, turning point confirmed a vulnerability. Point of inflection of the Zero Day [...]
Firefox 3, One of the Maximum Downloaded Open Source browser has just finished up with its World Record Download Day and here is one more big news about a possible Critical Vulnerability in Firefox 3
Devlabs from Tippingpoint has reported a critical vulnerability with high severity affecting Firefox 3 and prior versions of Firefox 2.0.x. on [...]
Zero Day Initiative’s Upcoming Advisories reported a critical vulnerability to newly released Mozilla Firefox 3.0 (ZDI-CAN-349).
According to TippingPoint’s DVLabs blog post —[…]this Firefox 3.0 vulnerability, also affects prior versions of Firefox 2.0.x, and it has been tested and reported to the Mozilla security team. While Mo
A little over a week ago, I wrote about a security advisory from Microsoft warning that Apple’s Safari Web browser for Windows introduces new vulnerabilities. Specifically, Microsoft said it allows automatic downloading of files to the Windows desktop, files that in some cases could be run without the user’s knowledge. Over the weekend, [...]
On April 8, 2008 Adobe released a Security Bulletin regarding vulnerabilities with various versions of Adobe Flash Player. In the Security Bulletin they recommend upgrading to the latest version of Adobe Flash Player (at least to version 9.0.124.0 or higher). However, various reports were published today from security firms and security related websites reminding users about the
In the past few months, Americans have seen a plethora of extreme weather ranging from extreme droughts in the south, tornado’s in the Midwest and unprecedented flooding in America’s heartland. Although we’ve all seen the disastrous affects of Mother Nature venting her rage over the course of our lives, at no time in recorded [...]
BitDefender informed that it had addressed the critical zero-day security flaw of Internet Explorer 7 and Internet Explorer 8 Beta 1 by issuing a signature update for its products. The Cross-Zone Scripting vulnerability in the browser’s “Print Table of Links” feature was discovered by independent security researcher Aviv Raff, who also made public the attack code [...]
An OpenSSL key vulnerability for Debian 4.0 and Debian-based Linux distributions was published on May 13th, 2008. This vulnerability has the potential to affect any systems which trust keys generated by Debian 4.0 and its derivative operating systems.
Please see the Debian and Debian-based Distribution Security Notice posted on the VPSLink forums and the SSL [...]
After investigating public reports, Microsoft has published Microsoft Security Advisory 951306, which describes a vulnerability that affects multiple versions of Windows (including Windows XP Professional Service Pack 2, all supported versions and editions of Windows Server 2003, Windows Vista, Windows Vista Service Pack 1, and Windows Server 2008.)
The newly found security flaw could potentially allow a malicious local [...]
日防夜防，家賊難防。這句諺語您應該耳熟能詳吧？這也很適合用來描述Windows的作業系統，現代人的電腦中幾乎都裝有防毒系統，在更多者甚至有防火牆、掃木馬等等安全軟體；但您知道這些軟體都無法擋住作業系統本身的漏洞嗎？而本軟體就是針對OS本身的漏洞加以掃描偵查，可以讓您早日針對問題修補、也就是像打了預防針。特別的是該工具還提供Protector Plus for Windows（作業系統防護外掛），以完整保護您的系統。
【網站網址】
相關文章
ESET SysInspector - NOD32公司推出的免費系統安全分析服務
TrueTransparency - 讓視窗邊框透明化
Active Lock - 把隨身碟當做電腦的鑰匙
把磁碟容量畫圖給你看 - WinDirSta
Late on Thursday Microsoft released an advisory about a new privilege escalation vulnerability affecting IIS and SQL Server on Windows XP, 2003, Vista, and Server 2008.
It’s likely that this is the...
[[ This is a content summary only. Visit my website for full links, other content, and more! ]]
Now, normally when I find an XSS vulnerability on a popular domain I just report it to the appropriate security team and move on, but this one is interesting…By taking advantage of the content-type returned by spreadsheets.google.com (and a caching flaw on the part of Google), I was able to pull off a full blown XSS against the google.com domain. For those of you who don’t understand what this means, allow me to elaborate. When Google sets their cookie, it is valid for all of their sub domains. So, when you log into gmail (mail.google.com), your gmail cookie is actually valid for code.google.com, docs.google.com, spreadsheets.google.com…and so on. If someone (like me) finds an XSS vulnerability in any one of these sub domains, I’ll be able to hijack your session and access any g
It is the type of vulnerability that Microsoft wanted to head off as long as possible, especially since Windows Vista’s new kernel was designed to thwart this possibility.
Now, as the company acknowledged in a security bulletin yesterday, a malicious program running as a local or network service can leverage another local or network service running [...]
Microsoft is investigating new public reports of a vulnerability which could allow elevation of privilege from authenticated user to LocalSystem, affecting Windows XP Professional Service Pack 2 and all supported versions and editions of Windows Server 2003, Windows Vista, and Windows Server 2008. Customers who allow user-provided code to run in an authenticated context, such [...]
The report that has been issued compiling the first year’s worth of security vulnerability’s found in Windows Vista, and comparing Windows XP and non-Microsoft OS’s first year vulnerabilities.
Here are a few highlights :
Metric
Windows Vista (year 1)
Windows XP (year 1)
Vulnerabilities fixed
36
65
Security Updates
17
30
Patch Events
9
26
Weeks with [...]
The third and final service pack for Windows XP is not even out, and Microsoft is already hammering away at it plugging security soles. Although it debuted in full development alongside Windows Vista SP1, Windows XP Service Pack 3 is yet to be finalized with the delivery planned by mid-2008. Since the end of [...]
Norton antivirus is one of the most trusted antivirs programs that many computer users use to protect them from various vulnerabilities like virus programs, mailware and many other vulnerabilities, but what if the antivirus program latest patches contain the vulnerabilities that can harm your computer system. This is what several people found that thses [...]
Is there such a thing as safety and security? A child relies on a security blanket to make the child feel safe, but every adult knows the blanket can do nothing to protect the child. Is any other thing we look to for security any different? What is it we are worried about?
Website -
Directly to RSS feed of podcast -
Namaste,
~ Eric Putkonen
As reported earlier on today about the PS3 Vulnerability and Network Hack which left weaknesses found on their PSN system (See Here), Sony have officially said sorry.
Sony officially Apologizes for the PS3 Vulnerability and Network Hack, we deserve more than just an apology because this should never have happened.
Hackers who discovered a way to hack [...]
"Details are still sparse (and primarily in Japanese), but our Tokyo bureau just let us know that Sony's announced a fairly severe security vulnerability on the PlayStation Network, which would actually allow an attacker to access your account, personal information, and Wallet -- but not your credit card on file -- as well as change your password."[via engadget]
MS Word subjected to selective attacks.
Microsoft confirms Word attacks
Microsoft has confirmed reports of vulnerability in Word that allows an attacker to exploit a system via the Microsoft Jet Database Engine, which shares data with Access, Visual Basic and third party applications.
Microsoft in its advisory said the potential for attack is “very limited.” Reports of the Word flaw were
I usually do not blog on Advisories we release as I guess that you subscribed to the corresponding alerts. If not, you should do that now
here.
This one is a little bit different as I know that quite some people within Microsoft are working during Easter because of this vulnerability. Therefore I want to make sure that you have seen it. Please read the Advisory called Vulnerability in Microsoft Jet Database Engine (Jet) Could Allow Remote Code Execution and make sure you do your proper risk assessment
Roger
I was going to use a WP-Uploads option for uploading pictures. This allows you to have a much easier time uploading pictures and linking to it on your blog posts. What I discovered was that you have to change the file permissions to 777 of the content folder, in order for wordpress to [...]
Apple had more than 5 times the number of flaws per month than Windows XP and Vista in 2007, and most of these flaws are serious. Clearly this goes against conventional wisdom because the numbers show just the opposite and it isn’t even close.
Summer Academy on Social Vulnerability 2008 - Call for Applications
The UNU-EHS Chair on Social Vulnerability, supported by MunichRe
Foundation, organises for the 3rd time the Summer Academy. The
academy, taking place from 20-26 July 2008 at the historic Hohenkammer
Castle (Schloss Hohenkammer) in the countryside outside of Munich,
Germany is entitled “Environmental Change, Migration, & Social
Vulnerability”. Once again, we are happy to be able to offer 20 places
for qualified PhD candidates working on dissertations related to
environmental change, migration and social vulnerability. We accept
applications for the 2008 Summer Academy until 15 January 2008. Please
apply online only by clicking on the provided link “apply now”.
Note:
Saya pernah ikut Summer Academy ini tahun 2007 dan benar-benar
mendapatkan manfaat yang besar dalam sharing riset tentang disaster
management, vulnerability, risk, etc.
From: www.ehs.unu.edu
La revista "SC Magazine" publico este año una evaluación de distintos productos especializados en el análisis de vulnerabilidades, para los que les gusta ver las virtudes y comentarios les recomendamos darle una lectura al articulo "Vulnerability assessment 2007" (Ingles)
This month we looked at vulnerability assessment and penetration test tools. The leading difference between last year’s tests
Last week I had the opportunity to spend two days on a rustic team building retreat at Joy Outdoor Education Center in Clarksville, Ohio, courtesy of a corporate client, Hill-Rom, where the group learned about their Insights® colors (courtesy of Scott Schwefel), did a high ropes course and related activities, endured gusts up to 34 mph and wind chills down to the teens (brrr!), shared emotionally-moving and personal stories deep into the night by light (and warmth) of a bonfire, slept in cabins, ate camp food, and stretched and grew in ways that were truly amazing. And that was Day One!Day Two included a morning of coaching and facilitation, courtesy of yours truly, and an afternoon of detailed departmental planning and goal-setting, led by Phillip Saxton, president of MiTowne.Initially, I perceived, and prepared for, my role as that of catalyst: "an agent that provokes or speeds significant change or action," as Merriam Webster might say. But as I settled into my bunk that first nigh
Microsoft® Windows® XP and Windows Server® 2003 systems are being attacked through CVE-2007-5587, a buffer overflow vulnerability in the Macrovision secdrv.sys driver.
Share This
Secunia.com 2007-11-01 , release at their website a vulnerability has been reported in Novell BorderManager, which can be exploited by malicious people to compromise a vulnerable system.The vulnerability is caused due to the Client Trust application incorrectly processing validation requests sent to the UDP port on which clntrust.exe is listening (by default 3024). This can be exploited to cause a heap-based buffer overflow by sending a specially crafted validation request containing a Novell tree name without backslash or zero wide characters.Successful exploitation allows execution of arbitrary code.The vulnerability is reported in Novell BorderManager 3.8. Prior versions may also be affected.Solution : Download patch from Vendor (http://download.novell.com/Download?buildid=AuOWp2Xsvmc~)6 Related Secunia Security Advisories 1. Novell BorderManager Unicode Encoding Detection Bypass2. Novell BorderManager ISAKMP Predictable Cookie Security Issue3. Novell BorderManager VPN Denial of Ser
More Vulnerabilities Found; More Platforms Affected
Severity: High
26 October, 2007
Update:
On Monday 22 October, we published an alert about a serious vulnerability that affects RealPlayer 10.5 and RealPlayer 11 beta running on Windows. By enticing one of your users to a malicious Web site, an attacker can exploit this vulnerability to execute code on your user’s computer, with your user’s privileges. In the worst case scenario, the attacker could gain total control of the victim’s PC. RealNetworks released a patch to fix that problem. However, it appears that update marked just the beginning of RealNetwork security holes.
Late yesterday, RealNetwork released the second batch of security updates this week, this time fixing six serious vulnerabilities in their media player product line. Here’s what you need to know about the new flaws.
The new flaws affect many more products than the earlier flaw did, including products that run in OS X and Linux. The affecte
A new government investigation warns that Internet hackers pose a threat to the nation's power grids, transit systems, pipelines and water plants. Bob Orr reports.
News Factor Network 24/10/2007Website: http://www.newsfactor.comAdobe patched its Acrobat and Reader programs on Monday. The fix plugs a hole that exposed Windows XP users to attackers sending PDF files containing malware. According to various reports, exploits are running rampant around the Internet in search of unpatched applications."Critical vulnerabilities have been identified in Adobe Reader and Acrobat that could allow an attacker who successfully exploits these vulnerabilities to take control of the affected system," Adobe said in a security bulletin. "A malicious file must be loaded in Adobe Reader or Acrobat by the end user for an attacker to exploit these vulnerabilities."Windows XP users who also run Internet Explorer 7 are at risk. Adobe first admitted to the bug about two weeks ago and posted a complex workaround that required users to edit the Windows registry. The flaw was first discovered on September 20 by "pdp" on the Gnucitizen Web site.Anatomy of the AttackAttacke
Liberation, Freedom, and Enlightenment – by its very nature – is an opening. It is a removing of walls and cords of attachment that restrict and confine, but also a removing of the shells and defenses used to protect the “little me.”
As we open, often there is a feeling of vulnerability and then fear – as we have been shown and taught to protect ourselves and that it is a dangerous world. We are taught not to trust people…that trust must be earned. Until it is earned, keep those walls and barricades up. What I suggest is demolition…embracing vulnerability.
Immediately the question may come to mind…what if I am hurt. My answer is that it is a certainty at some point you will be hurt. Accept it. Be willing to be hurt. If you open up and trust all – whether earned or not – you will be betrayed and hurt at some point…given enough time. But I find it is a small minority that will betray you. Would you close yourself off from a 100 because the 1 betrays
Yesterday I wrote about an arbitrary-code
vulnerability in RealPlayer being exploited.
RealNetworks has now issued a patch
that apparently remedies ...
A vulnerability has been reported in Asterisk, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially to compromise a vulnerable system.The vulnerability is caused due to a boundary error within the IMAP-specific code for processing voicemail messages. This can be exploited to cause a buffer overflow via a specially crafted voicemail message sent as email containing an overly long (more than 1024 characters) combination of Content-Type or Content-Description headers.Successful exploitation requires that a user listens to the voicemail message via a phone. The vulnerability is reported in 1.4.x versions prior to 1.4.13.Secunia ReportAsterisk Report and SolutionTags: Denial of Service, Asterisk, Secunia, Asterisk Security, IMAP, VoIP Security
from ComputerWorld UK 25/9/2007Website: http://www.computerworlduk.comGoogle's Gmail can be easily hacked, allowing any past and future emails to read by hackers, according to a vulnerability researcher.A "cross-site request forgery" (CSRF) bug was disclosed by Petko Petkov, a UK-based web vulnerability tester who has made a name for himself of late. In the past two weeks, Petkov has publicly posted information about critical, zero-day bugs in Apple's QuickTime, Microsoft's Windows Media Player and Adobe's Portable Document Format (PDF).According to Petkov, who declined to release details about the vulnerability, attackers can use Gmail's filtering feature to exploit the bug. An attack, he said, would start with a victim visiting a malicious website while also still logged into his Gmail account. The malicious site would then perform what Petkov called a "multi-part/form-date POST" - an HTML command that can be used to upload files - to one of the Gmail application programming int
If any relationship is to proceed beyond the point of acquaintance, there needs to be a moment which one of the persons risks making themselves vulnerable . This is the place a friendship will develop , proceed and deepen, stay the same, or fall apart. If the other person accepts the “risk offering” and is supportive regardless of the “insecurities”, then the relationship begins its movement towards a friendship. The other person will hopefully, reciprocate and share some of their vulnerabilities and the bonds of trust will strengthen. This all depends if the person taking the risk has enough trust to take the first step toward the other and “expose” some of their defenses.
In a previous essay, I suggested the first perception about the world comes from the first few days of life. If the infant gets the notion that the world is not a trust-able place, then all future perceptions will be filtered through it . Much of his/her
Severity: Medium
30 August, 2007
Summary:
Late yesterday, Yahoo released an update that fixes a security vulnerability affecting any version of Yahoo! Messenger installed before August 29, 2007. By enticing a Yahoo! Messenger user into visiting a malicious Web page, an attacker can exploit this new flaw to execute code on that user’s computer, and possibly gain full control of it. If you use Yahoo! Messenger in your network, or suspect that your users have installed it, either remove it or install the latest version.
Exposure:
Yahoo! Messenger is one of the many Instant Messaging applications that allow users to send real-time, pop-up messages to each other over the Internet. Instant Messaging is popular enough that your users might have installed the Yahoo! Messenger client on a company computer whether or not your policy authorizes it.
Yesterday, Yahoo released an advisory describing a buffer overflow vulnerability in an ActiveX control that ships with all previous versions of
An eavesdropping vulnerability was revealed on the popularFull Disclosure mailing list on Wednesday. Vulnerabilityresearchers Humberto Abdelnur, Radu State and Olivier Festorclaimed the exploit could allow a remote attacker to turn aVoIP phone into an eavesdropping device, citing a GrandstreamSIP phone as an example.While playing with the SIP Madynes stateful fuzzerfor a description see http://hal.inria.fr/inria-00166947/en),we have realized that some SIP stack engines have seriousbugs allowing to an attacker to automatically make a remotephone accept the call without ringing and without asking theuser to take the phone from the hook, such that the attackermight be able to listen to all conversations that take placein the remote room without being noticed.One example that wecan disclose (vendor was notified on 10 th May 2007) is thefollowing: Grandstream SIP Phone GXV-3000MADYNES Security Advisory : SIP remote attack onGrandstream SIP Phone GXV-3000Date of Discovery 7 th May, 2007
Спалю-ка я небольшую темку, как поиметь бэклинки с XSS-уязвимых сайтов.Вообще, XSS багов у меня уже вагон и маленькая тележка. Есть даже одна у Темы :).Ну, к делу.Ищем в любимом гугле intext:"PHP Version" intitle:"phpinfo()"И добавляем к найденым сайтам параметр ?f[]=%3Ca%20href%3Dhttp%3A//сайт%3Eанкор%3C/a%3EНапример, так.Проскрольте до блока Php Variables, там будут активные линки на ваш сайт.Все.
A vulnerability has been identified in Opera, which could be exploited by remote attackers to take complete control of an affected system. This issue is caused by an error when parsing specially crafted JavaScript data resulting in a virtual function call on an invalid pointer, which could be exploited by remote attackers to execute arbitrary commands by tricking a user into visiting a specially crafted web page.Affected ProductsOpera versions prior to 9.23SolutionUpgrade to Opera version 9.23 :http://www.opera.com/download/
A vulnerability has been discovered in Microsoft Windows, which can be exploited by malicious people to compromise a vulnerable system.The vulnerability is caused due to an input validation error within the handling of system default URIs with registered URI handlers (e.g. "mailto", "news", "nntp", "snews", "telnet"). This can be exploited to execute arbitrary commands when a user e.g. using Firefox visits a malicious website with a specially crafted "mailto" URI containing a "%" character and ends in a certain extension (e.g. ".bat", ".cmd")Examples:mailto:test%../../../../windows/system32/calc.exe".cmdnntp:../../../../../Windows/system32/telnet.exe" "secunia.com 80%.batSuccessful exploitation requires that Internet Explorer 7 is installed on the system.The vulnerability is confirmed on a fully patched Windows XP SP2 and Windows Server 2003 SP2 system using Firefox version 2.0.0.5 and Netscape Navigator version 9.0b2. Other versions and browsers may also be affected.Solution:Do not br
The ripples from the problematic way special URLs are handled, discovered last week, continue to spread. Research by heise Security showed that as well as Firefox, other applications like Skype or Miranda can act as a gateway for the problem. This strongly suggests that the actual cause of the problem is the confusing way in which Windows handles URLs. If a program considers that it is not responsible for dealing with a URL type such as mailto:, it passes such URLs to the operating system to be dealt with further. Under Windows XP, however, what then happens depends on whether or not Internet Explorer 7 is installed (even if IE has nothing to do with the protocol in question).
(more…)
Share This
OPEN SOURCE VULNERABILITY DATABASE (OSVDB)OSVDB es una base de datos abierta e independiente de vulnerabilidades. Tiene como meta proporcionar información técnica, detallada, actual e imparcial de diversas plataformas y aplicacionesEste proyecto Open Source promueve la colaboración abierta entre las compañías y los individuos, busca eliminar trabajos redundantes, y reducirá los costos inherentes con el desarrollo y el mantenimiento de las bases de datos internas de la vulnerabilidades.El sitio oficial: http://www.osvdb.org/ ofrece la posibilidad de realizar búsquedas con distintos filtros en la base de datos:Vulnerability TitleDisclosure Date RangeReferenceTextVendorProductVersionVulnerability Classification:· Location: Physical, Local, Remote, Telephony and Unknown.· Attack Type: Authentication, Cryptographic, Denial Of Service, Hijacking, Information Disclosure, Infrastructure, Input Manipulation, Misconfiguration, Race Condition, Other and Unknown.· Impact: Loss of Confide
Very important, The last version of Firefox 2.0.0.5 contains a vulnerability in the password administration that allows malicious websites to steal your password. If you have Javascript enabled and let firefox to remember your passwords, you’re in danger.
Mozilla’s team fixed a similar problem in November, one that didn’t require Javascript. However, Heise Security launched a site to let you check if you are vulnerable or not to this problem.
My recommendations are:
Use NoScript.
Visit known websites until the problem is fixed
Don’t ever try to use the option to remember your password in Firefox
Just a note, Safari users has this same problem with their browser.
critical, firefox, javascript, noscript, password, vulnerabilityShare This
Rootkit.com said local vulnerability in Kaspersky Antivirus, which allows complete computer crash. According to the Rootkit.com all attempts to notify the Kaspersky Laboratory were unsuccessful. The vulnerability was discovered Ms-Rem few years ago for the older version of Kaspersky Antivirus, last summer was published exploits for Kaspersky AV 6.0, and now confirmed vulnerability to Kaspersky Antivirus 7.0. The vulnerability is caused by a problem with incorrect call NtOpenProcess parameters. This feature is called the driver klif.sys for Kaspersky AV protection from unauthorized access. The site Kaspersky Antivirus, vulnerability author has not tried to contact the developers and published details before a correction. It also reported that the vulnerability can be used to execute arbitrary code, and leads only to restart the computer. Correction to discovered vulnerabilities will be released shortly and will be installed automatically to users.
Después de que ayer se publicara acerca de la Vulnerabilidad de KAS 7.0 Kaspersky Lab reacciono diciendo que no fueron notificados a tiempo con todo y que la vulnerabilidad tenia un año o mas he aquí lo que Kaspersky respondió hoyEl enlace original en inglesUn consultor (EP_X0FF), recientemente ha publicado en rootkit.com acerca de una vulnerabilidad en KAV 7.0. Desafortunadamente el autor de este material no se ha apegado a la practica estándar de la industria, de contactar a la empresa desarrolladora antes de divulgar los detalles de la vulnerabilidad. Aunque el autor afirma que todos los intentos de informar a Kaspersky Lab acerca de esta vulnerabilidad, fueron ignorados, este no ha sido el caso: Si hubiéramos sido informados, este hecho hubiera sido resuelto desde mucho tiempo atrás.Los siguientes productos son vulnerables:Kaspersky Internet Security 6.0/7.0Kaspersky Anti-Virus 6.0/7.0Kaspersky Anti-Virus for Windows Workstations 6.0Kaspersky Anti-Virus 6.0 for Windows Serv
Escanea y detecta las vulnerabilidades de tu WindowsMicrosoft de vez en cuando, lanza una serie de parches para solucionar las vulnerabilidades encontradas en sus sistemas operativos.A veces te pide instalarlas mientras se apaga la computadora o debes instalarlas manualmente.Windows Vulnerability Scanner 1.10, escanea y detecta todas las vulnerabilidades de tu Windows.Además ofrece un link hacie la parche de seguridad para solucionar este problema, con tan sólo hacer click en el nombre del parche.No necesitas instalarlo, sólo copiarlo en el disco duro y ejecutarlo cuando quieras.Sólo detecta en Windows 2000, Windows XP y Windows 2003 Servers.[Descargar Windows Vulnerability Scanner 1.10]
Microsoft Security Bulletin MS07-025 - Vulnerability in Microsoft Office Could Allow Remote Code Execution (934873) This update resolves a privately reported vulnerability. The vulnerability is documented in its own subsection in the Vulnerability Details section of this bulletin. An attacker who successfully exploited this vulnerability could take complete control of an affected system. [...]
