More from CanSecWest 2013

Pwn2Own, Pwnium Attract Dollars and 0-Days by the Bushel Groundbreaking Cyber Fast Track Research Program Ending At Pwn2Own, Browser Exploits Getting Harder, More Expensive to Find Firefox, Java, Flash All Taken Down at Pwn2Own How Facebook Prepared to Be Hacked...

Chrome, Firefox, Java, IE10 exploited at Pwn2Own competition

During the first day of Pwn2Own competition at the CanSecWest conference in Vancouver , latest versions of all major browsers were exploited by hackers. Chrome, Firefox and Internet Explorer 10 on Windows 8 were successfully pwned by various competitors, bringing them tens of thousands of dollars...

At Pwn2Own, Browser Exploits Getting Harder, More Expensive to Find

VANCOUVER–The Pwn2Own contest has evolved in many ways over the years, from new rules to new targets to larger prizes, but perhaps the one thing that has changed the most is that the researchers who show up here every year hoping to go home with a bag full of money are having to spend more and mo...

Pwn2Own, Pwnium Attract Dollars and 0-Days by the Bushel

The new year is barely two months old and it’s already been a brutal one for the disclosure of new vulnerabilities. Java, Adobe Reader, Flash, Google Chrome and a number of other widely deployed applications have all been hit with a slew of serious bugs in just the last few weeks. And that’s like...

VUPEN Security Research - Microsoft Windows OLE Automation Code Execution Vulnerability

VUPEN Security Research - Microsoft Windows OLE Automation Remote Code Execution Vulnerability Website : http://www.vupen.com Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- Microsoft Windows is a series of software operating systems and graphical user interfaces produced b...

SuSE 11.2 Security Update : flash-player (SAT Patch Number 7431)

flash-player has been updated to 11.2.202.273 security update, which fixes several critical security bugs that could have been used by remote attackers to execute code. CVE-2013-0504 / CVE-2013-0643 / CVE-2013-0648 More information can be found on :...

Software Security Programs May Not Be Worth the Investment for Many Companies

SAN FRANCISCO–The discipline of software security has been gaining traction in a lot of organizations both large and small in recent years, thanks in part to the success that vendors such as Microsoft, Adobe and others have had with it. However, for many companies, the time and money spent on...

MiniDuke Espionage Malware Hits Governments in Europe Using Adobe Exploits

New espionage malware has been discovered that targets a patched sandbox-bypass vulnerability in Adobe Reader. The attacks have hit a relatively small number of government victims in 23 countries, primarily in Europe, and rely on a string of unusual tactics, including the use of steganography to...

MS KB2819372: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10

The remote host is missing KB2819372. It may, therefore, be affected by the following vulnerabilities related to the installed version of the Adobe Flash ActiveX control : - A buffer overflow error exists related to the 'broker service'. CVE-2013-0504 - An unspecified error exists related to...

SuSE 10 Security Update : acroread (ZYPP Patch Number 8474)

Acrobat Reader was updated to 9.5.4 which fixes two critical security issues where attackers supplying PDFs could have caused code execution with acrobat. CVE-2013-0640 / CVE-2013-0641 More information can be found on : https://www.adobe.com/support/security/bulletins/apsb13-07.html %NASLMINLEVEL...

uTorrent 3.x app exploit 0day

Exploit for windows platform in category local exploits This is private exploit. You can buy it at https://0day.today...

CKEditor < 4.0.1.1 Multiple Vulnerabilities

CKEditor is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:ckeditor:ckeditor"; ifdescription...

USN-1748-1: Thunderbird vulnerabilities

Bobby Holley discovered vulnerabilities in Chrome Object Wrappers COW and System Only Wrappers SOW. If a user were tricked into opening a specially crafted page and had scripting enabled, a remote attacker could exploit this to bypass security protections to obtain sensitive information or...

Java Applet JMX Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rex' class Metasploit3 false def initialize inf...

Sun Java JRE Image Parsing Vulnerabilities (102934) (Unix)

According to its version number, the Sun Java Runtime Environment JRE installed on the remote host reportedly is affected by a buffer overflow in its image processing code as well as another issue that may cause the Java Virtual Machine to hang. %NASLMINLEVEL 70300 C Tenable Network Security, Inc...

Ubuntu 10.04 LTS : linux-ec2 vulnerability (USN-1737-1)

Suleiman Souhlal, Salman Qazi, Aaron Durbin and Michael Davidson discovered a race condition in the Linux kernel's ptrace syscall. An unprivileged local attacker could exploit this flaw to run programs as an administrator. Note that Tenable Network Security has extracted the preceding description...

Oracle Java SE Multiple Vulnerabilities (October 2012 CPU) (Unix)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is earlier than 7 Update 9 / 6 Update 37 / 5.0 Update 38 / 1.4.240 and is, therefore, potentially affected by security issues in the following components : - 2D - Beans - Concurrency - Deployment - Hotspo...

Oracle Java SE Multiple Vulnerabilities (June 2012 CPU) (Unix)

The version of Oracle formerly Sun Java SE or Java for Business installed on the remote host is earlier than 7 Update 5 / 6 Update 33 / 5.0 Update 36 / 1.4.238 and is, therefore, potentially affected by security issues in the following components : - 2D - Deployment - Hotspot - Swing - CORBA -...

NBC Website Hacked, Leading Visitors to Citadel Banking Malware

Another day, another media company hacked. This time it’s NBC which has fallen to victim hackers on the heels of compromises of the New York Times and Wall Street Journal websites. Various experts have confirmed that NBC’s website is compromised and leading visitors to the dangerous Citadel banki...

Avoid The Attack Attribution Distraction

Plenty has been written this month about attack attribution, but, really, if your network is under siege, how often does the “who” matter as much as the “how,” “what,” and “where”? It seems that knowing who the actor is behind a network intrusion matters little to a bank, restaurant or retail...