CVE-2011-0197

App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions...

CVE-2011-0197

CVE-2011-0197 affects Apple Mac OS X (App Store) prior to 10.6.8, where App Store could log a user’s AppleID password to a local file with insufficient permissions, enabling local users to read the password. The root cause is credentials being written to a log entry; an improved handling of crede...

Apple Issues Huge Security Update, Releases OS X 10.6.8

Apple has released a massive set of security updates for Mac OS X and a number of other applications, fixing a total of 39 separate vulnerabilities in programs including QuickTime, MobileMe and others. The company also released OS X 10.6.8. One of the more serious bugs that Apple fixed with the...

Mac OS X Multiple Vulnerabilities (Security Update 2011-004)

The remote host is running a version of Mac OS X 10.5 that does not have Security Update 2011-004 applied. This update contains security- related fixes for the following components : - AirPort - App Store - ColorSync - CoreGraphics - ImageIO - Libsystem - libxslt - MySQL - patch - Samba -...

PT-2011-2177

Name of the Vulnerable Software and Affected Versions Apple Mac OS X versions prior to 10.6.8 Description The issue allows local users to potentially obtain sensitive information by reading a log file. This is because the App Store in Apple Mac OS X creates a log entry containing a user's AppleID...

CVE-2011-0197: Exposure of Sensitive Information to an Unauthorized Actor

App Store in Apple Mac OS X before 10.6.8 creates a log entry containing a user's AppleID password, which might allow local users to obtain sensitive information by reading a log file, as demonstrated by a log file that has non-default permissions...

Mac OS X 10.6.x < 10.6.8 Multiple Vulnerabilities

The remote host is running a version of Mac OS X 10.6.x that is prior to 10.6.8. This update contains security-related fixes for the following components : - App Store - ATS - Certificate Trust Policy - CoreFoundation - CoreGraphics - FTP Server - ImageIO - International Components for Unicode -...

Mac OS X 10.6 < 10.6.8 Multiple Vulnerabilities

Binary data 800790.prm...

Game Maker: 40 Percent of iTunes App Purchases Are Fraud

A Hong Kong based developer of games for mobile devices says that its online, multi player games are being besieged by users making fraudulent purchases from compromised iTunes accounts and says that iPhone maker Apple has turned a deaf ear to its efforts cut off the bogus activity. In an e-mail...

Mozilla introduces the "Web Apps" project just before release of release of Firefox 4 final !

Shortly before the release of the final version of Firefox 4, the Mozilla developers have introduced the "Web Apps" project. These apps are expected to play a major role play in future browsers, and in such a future, the browser will not just be for viewing web pages but will be a platform for...

Analysis Shows DroidDream Trojan Designed for Future Monetization

A detailed analysis of the DroidDream Trojan that was found in dozens of apps in the Android Market this week shows that the malware has a modular construction that likely was designed to give attackers the ability to monetize infected devices through installations of adware or spyware. The Troja...

DroidDream Attack Underscores Weaknesses of App Stores

The Android Market incident that surfaced Wednesday in which Google was forced to pull more than 20 apps that had been Trojaned is the latest piece of evidence that the mobile app store model is broken and is setting users up for failure. The details of the Android Market episode should be famili...

Google Ships Chrome 9, Plug Nine Security Holes

Google has officially released version 9.0.597.84 of its Chrome web browser to stable and beta channels for Windows, Mac and Linux, an update that addresses nine separate security vulnerabilities. According to Google’s Chrome Releases blog, one of the vulnerabilities is rated critical while two a...

Mac App Store Safeguards Bypassed, Opening Up Pirated Apps

Just a day after Apple introduced its Mac App Store, some users already have found a way around the DRM system designed to ensure that they have paid for the apps that they’re using. The technique seems to work only on apps that don’t correctly implement the method for checking the App Store...

Apple Releases OS X 10.6.6 With One Bug Fix, Mac App Store

Apple issued a fix for just one security vulnerability in the release of the latest version of its Mac OS X software on Thursday. OS X 10.6.6 fixes a flaw in PackageKit, a software installation and updating tool. The newest version of OS X is mostly notable for its inclusion of the Mac App Store...

iPhone FTP Server (WiFi FTP) by SavySoda - Denial of Service (PoC)

!/usr/bin/python Title: iPhone - FTP Server WiFi FTP by SavySoda DoS/PoC Date: 02-18-2010 Author: b0telh0 Link: app store http://itunes.apple.com/br/app/ftp-server/id346724641?mt=8 Tested on: iPhone 3G firmware 3.1.3 The server doesn't crash at all, but after exploiting it you can't see list your...

Apple Boots iPhone Hackers from Apps Store

Apple has banned at least two prominent iPhone hackers from accessing its App Store. Read the full article. The Register...

Apple iPhone / iPod My DBLite Edition Denial Of Service

!/usr/bin/python Apple Iphone/Ipod - My DBLite Edition Remote 0day DOS exploit Found by: Jason Bowes - admin @ blue-dogz.com App Homepage: www.xenugo.co Price: Free Download: From the app store use your itunes account Tested on: Iphone 3GS - firmware 3.1.2 What's up to slicc1 Advisory: print "+...

Rogue iPhone Apps Explored at Black Hat

Lax security screening at Apple’s App Store and a design flaw are putting iPhone users at risk of downloading malicious apps that could steal data and spy on them, a Swiss researcher warns at Black Hat DC. Read the full article. cnet...

Android App Is Rogue Phishing Scam

A phisher hoping to harvest bank login details managed to smuggle his app onto the Android app store. Malicious apps posted by Droid09 were quickly identified, prompting a warning to legitimate users and a ban for the VXer. Read the full article. The Register...