jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

jakarta-commons-daemon: jsvc does not drop capabilities allowing access to files and directories owned by the superuser

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

NATO Looks to Team With India To Fight Cybercrime

The North Atlantic Treaty Organization NATO is looking to enlist the help of India when it comes to contending with cyber threats from China, according to a recent report. According to a piece in the Economic Times, NATO hopes to strengthen its ties with the Southeast Asia republic, citing its...

Department of Homeland Security warns Anonymous Hackers

Department of Homeland Security warns Anonymous Hackers The Department of Homeland Security is beginning to take Anonymous and other non-professional cyber-attackers more seriously as it issues a warning about potential attacks. The 2 September security bulletin from the DHS National Cyber-Securi...

xmpp-info NSE Script

Connects to XMPP server port 5222 and collects server information such as: supported auth mechanisms, compression methods, whether TLS is supported and mandatory, stream management, language, support of In-Band registration, server capabilities. If possible, studies server vendor. Script Argument...

MTPuTTY 1.0 Beta - Multi-Tabbed PuTTY Released

MTPuTTY 1.0 Beta - Multi-Tabbed PuTTY Released MTPuTTY Multi-tabbed PuTTY helps you to manage different PuTTY connections in one tabbed GUI interface. Every PuTTY connection runs in a separate tab and you can switch between PuTTYs as easy as you switch between opened pages in web browsers. When y...

Fixed in Apache Tomcat 6.0.33

Moderate: Multiple weaknesses in HTTP DIGEST authentication CVE-2011-1184 Note: Mitre elected to break this issue down into multiple issues and have allocated the following additional references to parts of this issue: CVE-2011-5062, CVE-2011-5063 and CVE-2011-5064. The Apache Tomcat security tea...

CVE-2011-2729

CVE-2011-2729 affects the Jakarta Commons Daemon jsvc component in Tomcat runtimes (Tomcat 5.5.32–5.5.33, 6.0.30–6.0.32, and 7.0.x before 7.0.20) where jsvc did not properly drop capabilities. This allows a remote attacker to bypass read permissions for files via an application request. The root ...

CVE-2011-2729

native/unix/native/jsvc-unix.c in jsvc in the Daemon component 1.0.3 through 1.0.6 in Apache Commons, as used in Apache Tomcat 5.5.32 through 5.5.33, 6.0.30 through 6.0.32, and 7.0.x before 7.0.20 on Linux, does not drop capabilities, which allows remote attackers to bypass read permissions for...

Fedora Update for libcap FEDORA-2011-9844

Check for the Version of libcap OpenVAS Vulnerability Test Fedora Update for libcap FEDORA-2011-9844 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

[SECURITY] Fedora 15 Update: libcap-2.22-1.fc15

libcap is a library for getting and setting POSIX.1e formerly POSIX 6 draft 15 capabilities...

Fedora Update for libvirt FEDORA-2011-9062

Check for the Version of libvirt OpenVAS Vulnerability Test Fedora Update for libvirt FEDORA-2011-9062 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

Nmap NSE net: mysql-info

Connects to a MySQL server and prints information such as the protocol and version numbers, thread ID, status, capabilities, and the password salt. If service detection is performed and the server appears to be blocking our host or is blocked because of too many connections, then this script isn'...

Nmap NSE net: pop3-capabilities

Retrieves POP3 email server capabilities. POP3 capabilities are defined in RFC 2449. The CAPA command allows a client to ask a server what commands it supports and possibly any site-specific policy. Besides the list of supported commands, the IMPLEMENTATION string giving the server version may be...

Nmap NSE net: imap-capabilities

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Nmap NSE net: pop3-capabilities

This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Audit Finds FBI Doing a Poor Job with Cyber Investigations

A U.S. Department of Justice audit of the FBI’s ability to investigate cyber intrusions concluded that the agency is not doing an adequate job. The audit, which reviewed 36 field agents in 10 FBI offices across the country found that the agency’s cyber investigations are hampered by difficulties...

New Metasploit 3.6 Targets Security Compliance !

Security vulnerability testing is getting a boost this week with the release of Metasploit 3.6. Metasploit Pro, the commercial version of the product, now includes new PCI compliance reporting capabilities. There is also a new Project Activity Report, which helps organization manage and track...

Progress Crawls in Securing Critical Infrastructure

The US government is progressing at a snail’s pace in securing critical American infrastructure according to a Center for Strategic and International Studies CSIS commission on cybersecurity examining the first two years of the 44th presidency. Two years ago the CSIS published Securing Cyberspace...

Linux Kernel 2.6.37 (RedHat Ubuntu 10.04) - Full-Nelson.c Local Privilege Escalation

Linux Kernel 2.6.37 RedHat Ubuntu 10.04 - Full-Nelson.c Local Privilege Escalation / Linux Kernel = 2.6.37 local privilege escalation by Dan Rosenberg @djrbliss on twitter Usage: gcc full-nelson.c -o full-nelson ./full-nelson This exploit leverages three vulnerabilities to get root, all of which...