13674 matches found
Fedora 20 : check-mk-1.2.4p2-2.fc20 (2014-6810)
Install the mk-job binary on /usr/bin. - Make sure the proper permissions are given to /var/lib/checkmkagent/job to prevent any hard or symlink to be created by a normal user and pointing to any file on the filesystem exposing it on the check-mk-agent output being run as root. Note that Tenable...
ICS-CERT Alert on Easily Hackable Road Signs
A new, remotely exploitable vulnerability in Daktronics’ Vanguard software could make it even easier for attackers to hack electronic road signs, a task that was reportedly never very difficult to begin with. Daktronics’ Vanguard dynamic highway message sign configuration software was initially...
Ubuntu 12.04 LTS : linux-lts-raring vulnerabilities (USN-2238-1)
Pinkie Pie discovered a flaw in the Linux kernel's futex subsystem. An unprivileged local user could exploit this flaw to cause a denial of service system crash or gain administrative privileges. CVE-2014-3153 A flaw was discovered in the Linux kernel's IPC reference counting. An unprivileged loc...
Dan Farmer Presents Research on IPMI Vulnerabilities
If enterprises are indeed moving services off premises and into the cloud, there are four letters those companies’ IT organizations should be aware of: IPMI. Short for Intelligent Platform Management Interface, these tiny computers live as an embedded Linux system attached to the motherboards of...
New OpenSSL MITM Flaw Affects All Clients, Some Server Versions
There is a new, remotely exploitable vulnerability in OpenSSL that could enable an attacker to intercept and decrypt traffic between vulnerable clients and servers. The flaw affects all versions of the OpenSSL client and versions 1.0.1 and 1.0.2-beta1 of the server software. The new vulnerability...
Vulnerability Management: Think Like an Attacker to Prioritize Risks
Attackers care about ROI – they want to accomplish their objective with the least investment of time and resources possible. The same is true for you - to most effectively manage vulnerabilities, you need to think like an attacker. Ask yourself: How would you go about compromising systems,...
Phishing Campaign Sending Dropbox Links to Zeus Downloads
With more enterprises sharing documents through Dropbox, the free online storage service is popping up in more spam and phishing scams. The latest doesn’t necessarily target data stored by individuals and companies on Dropbox, but instead preys on the trust users have in the service. Researchers ...
Bro - Passive Open-Source Network Traffic Analyzer
While focusing on network security monitoring, Bro provides a comprehensive platform for more general network traffic analysis as well. Well grounded in more than 15 years of research, Bro has successfully bridged the traditional gap between academia and operations since its inception. Today, it ...
Sendmail < 8.14.9 close-on-exec SMTP Connection Manipulation
The remote mail server is running a version of Sendmail prior to 8.14.9. It is, therefore, affected by a flaw related to file descriptors and the 'close-on-exec' flag that may allow a local attacker to cause unspecified impact on open SMTP connections. C Tenable Network Security, Inc...
[SECURITY] Fedora 20 Update: smb4k-1.1.2-1.fc20
Smb4K is an SMB/CIFS share browser for KDE. It uses the Samba software suit e to access the SMB/CIFS shares of the local network neighborhood. Its purpose i s to provide a program that's easy to use and has as many features as possible...
[SECURITY] Fedora 19 Update: smb4k-1.1.2-1.fc19
Smb4K is an SMB/CIFS share browser for KDE. It uses the Samba software suit e to access the SMB/CIFS shares of the local network neighborhood. Its purpose i s to provide a program that's easy to use and has as many features as possible...
San Diego State Warns of Possible Data Breach
San Diego State University has notified some of its current and former enrollees that some of their personal information may have been accessed by unauthorized users, after a database containing the information was found to be accessible by anyone on the affected department’s wired network. The...
SEC Consult SA-20140528-0 :: Root Backdoor & Unauthenticated access to voice recordings in NICE Recording eXpress
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SEC Consult Vulnerability Lab Security Advisory 20140528-0 ======================================================================= title: Root Backdoor & Unauthenticated access to voice recordings product: NICE Recording eXpress voice recording soluti...
Fedora 20 : libtiff-4.0.3-15.fc20 (2014-6583)
Add upstream patches for CVE-2013-4243 996832 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...
Siemens Fixes DoS Flaw in Rugged OS Devices
Siemens has patched a denial-of-service vulnerability that affected many versions of its Rugged Operating System, software that runs on some of the company’s RuggedCom switches and serial-to-ethernet devices. The vulnerability could enable a remote attacker to cause the Rugged OS software to cras...
Ubuntu 12.04 LTS : linux-lts-saucy vulnerabilities (USN-2225-1)
Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory. CVE-2014-1738 Matthew Daley reported a flaw in the handling of ioctl commands by the floppy...
Ubuntu 10.04 LTS : linux-ec2 vulnerabilities (USN-2220-1)
Matthew Daley reported an information leak in the floppy disk driver of the Linux kernel. An unprivileged local user could exploit this flaw to obtain potentially sensitive information from kernel memory. CVE-2014-1738 Matthew Daley reported a flaw in the handling of ioctl commands by the floppy...
Adobe ColdFusion HTTP Response Splitting (APSB12-15) (credentialed check)
The version of Adobe ColdFusion running on the remote host is affected by an HTTP response splitting vulnerability. The coldfusion.filter.ComponentFilter class does not properly sanitize input used in the Location header of an HTTP response. A remote attacker could exploit this by tricking a user...
Fedora 20 : python-django14-1.4.13-1.fc20 (2014-6442)
fix for CVE-2014-1418 Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C Tenable...
SNMP Reflection DDoS Attacks on the Rise
The DDoS techniques have massively increased with the attackers becoming more skillful at working around the network security. A massive 300Gbps DDoS attack launched against Spamhaus website almost broke the Internet a year ago and also earlier this year, hackers have succeeded in reaching new...