Core Infrastructure Initiative Open Source Security Badge Program

The Core Infrastructure Initiative CII, a consortium of technology companies guided by The Linux Foundation, has thrown good money at solving the security woes of open source software. Since its inception last year, it has provided funding for the OpenSSL project allowing it to hire full-time hel...

[CVE-2015-3253] Apache Groovy Zero-Day Vulnerability Disclosure

Severity: Important Vendor: The Apache Software Foundation Versions Affected: All unsupported versions ranging from 1.7.0 to 2.4.3. Impact Remote execution of untrusted code, DoS Description When an application has Groovy on classpath and that it uses standard Java serialization mechanims to...

Oh Gosh! Four Zero Day Vulnerabilities Disclosed in Internet Explorer

How many Zero-Days do you think could hit Microsoft today? Neither one nor two; this times its Four. The Hewlett-Packard's Zero-Day Initiative ZDI has disclosed four new zero-day vulnerabilities in Microsoft's Internet Explorer browser that could be exploited to remotely execute malicious code on...

Google Helps Lead Effort Against Automated Traffic From Data Centers

Google is helping to lead a new effort to reduce the amount of fraudulent traffic that emanates from data centers and produces artificial clicks on ads. The collaborative initiative will rely on blacklists of known-bad IP addresses that Google and others maintain to help identify bots that are us...

DLA-274-1 groovy - security update

Bulletin has no description...

Census Project Identifies Open Source Projects at Risk

Heartbleed may have brought on a major case of heartburn last April for system admins worldwide, but a positive offshoot of the biggest of the Internet-wide bugs was that it opened a lot of eyes to the lack of support afforded even ubiquitous open source software projects. Shortly after Heartblee...

These Laser Beams Will Offer Free Internet to the World from the Sky

During a wide-ranging online question-and-answer session on his Facebook page Tuesday, Facebook co-founder Mark Zuckerberg predicted some wild things for Future. It includes: Telepathy Technology, the ability for humans to talk to each other with their minds. Laser Beams, used to transmit data fr...

HP Releases Details, Exploit Code for Unpatched IE Flaws

Researchers at HP’s Zero Day Initiative have disclosed full details and proof-of-concept exploit code for a series of bugs they discovered that allow attackers to bypass a key exploit mitigation in Internet Explorer. The disclosure is a rarity for ZDI. The company typically does not publish...

TinySRP Buffer Overflow

Dear Fulldisclosure, I submitted the below vulnerability to the HP Zero Day Initiative. They responded that they are not interested in vulnerabilities in this "product". Further, I tried to contact one of the authors Eric A. Young; the email bounced. I am busy with my day job and do not have the...

Apple Fixes WebKit Vulnerabilities in Safari Browser

Apple has updated its Safari browser, fixing a handful of exploitable WebKit flaws in various versions of Safari. WebKit is the core layout engine responsible for rendering webpages in the Safari browser. The first bulletin, vulnerabilities uncovered by Apple, resolves multiple memory corruption...

Chrome, Firefox, Safari and IE – All Browsers Hacked at Pwn2Own Competition

The Annual Pwn2Own Hacking Competition 2015 held in Vancouver is over and participants from all over the world nabbed $557,500 in bug bounties for 21 critical bugs in top four web browsers as well as Windows OS, Adobe Reader and Adobe Flash. During the second and final day of this year’s hacking...

Flash, Reader, Firefox and IE All Fall On First Day of Pwn2Own

Four different research teams on Wednesday cracked four products–Adobe Flash, Reader, Mozilla Firefox, and Microsoft Internet Explorer—and collectively earned a payout of $317,000 on the first day of Pwn2Own 2015. The annual hacking contest, which kicked off Wednesday in Vancouver, runs...

OpenSSL to Patch High Severity Vulnerability this Week

The OpenSSL Foundation is set to release a handful of patches for undisclosed security vulnerabilities in its widely used open source software later this week, including one that has been rated "high" severity. In a mailing list note published last night, Matt Caswell of the OpenSSL Project Team...

Details Surface on Stuxnet Patch Bypass

It took 10 hours to find what had eluded others for close to five years. German computer science student Michael Heerklotz spent the Christmas holiday reading Countdown to Zero Day, a narrative on the discovery and impact of Stuxnet, the computer worm considered one of the first cyberweapons, and...

Patched Windows Machines Exposed to Stuxnet LNK Flaw All Along

A five-year-old Microsoft patch for the .LNK vulnerability exploited by Stuxnet failed to properly protect Windows machines, leaving them exposed to exploits since 2010. Microsoft today is expected to release a security bulletin, MS15-020, patching the vulnerability CVE-2015-0096. It is unknown...

OpenSSL Security Audit Ready to Start

Funding from the Core Infrastructure Initiative has helped the maintainers of OpenSSL, one of the Internet’s most-deployed pieces of open source software, begin to get the crypto implementation on its feet. Despite its ubiquity, OpenSSL has historically been under-funded and under-resourced, thou...

Radia Client Automation radexecd.exe command injection

Added: 02/25/2015 CVE: CVE-2015-1497 BID: 72612 OSVDB: 118382 Background Radia Client Automation is an endpoint management solution. Problem The radexecd.exe daemon does not properly authenticate or sanitize user requests, allowing remote attackers to execute arbitrary commands. Resolution Use th...

Radia Client Automation radexecd.exe command injection

Added: 02/25/2015 CVE: CVE-2015-1497 BID: 72612 OSVDB: 118382 Background Radia Client Automation is an endpoint management solution. Problem The radexecd.exe daemon does not properly authenticate or sanitize user requests, allowing remote attackers to execute arbitrary commands. Resolution Use th...

Google Project Zero Vulnerability Disclosure Grace Period

Google’s unwavering vulnerability disclosure deadlines are the latest chapter in a decades-long debate about how to best inform affected users that there’s a security problem with their software. Since the start of the year, Google’s 90-day clock has most notably ticked down to zero on a trio of...

Schneider Electric Patches Buffer Overflow in ICS Products

There is a remotely exploitable buffer overflow in a handful of software products from Schneider Electric that could allow an attacker to execute arbitrary code on vulnerable machines. The vulnerability lies in a DLL that’s installed with a Device Type Manager that is part of several Schneider...