Sourcefire Snort rule20275eval Buffer Overflow

A buffer overflow vulnerability has been reported in a pre-compiled Snort rule distributed by Sourcefire. The vulnerability is due to a stack buffer overflow in rule 3:20275.A remote attacker can exploit this issue by sending a malicious response packet containing a overly long message to the...

ISC BIND 9 DNS64 远程拒绝服务漏洞

BUGTRAQ ID: 57556 CVECAN ID: CVE-2012-5689 BIND是一个应用非常广泛的DNS协议的实现。 ISC BIND 9.8.x、9.9.x在某些配置中，DNS64的响应策略区域缺少AAAA重写规则，远程攻击者通过AAAA记录查询，可造成拒绝服务（断言失败并退出指定程序）。 0 ISC BIND 9.9.x ISC BIND 9.8.x 临时解决方法： 2013年1月24日厂商已经发布beta版本，修复了此漏洞。如果您不能立刻安装补丁或者升级，NSFOCUS建议您采取以下措施以降低威胁： 确保RPZ包含每个A重写规则的AAAA重写规则。 厂商补丁： IS...

SuSE 11.2 Security Update : LibreOffice (SAT Patch Number 6804)

LibreOffice was updated to SUSE 3.5 bugfix release 13 based on upstream 3.5.6-rc2 which fixes a lot of bugs. The following bugs have been fixed : - polygon fill rule. bnc759172 - open XML in Writer. bnc777181 - undo in text objects fdo36138 - broken numbering level. bnc760019 - better MathML...

UBUNTU-CVE-2012-5689

ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service assertion failure and named daemon exit via a query for an AAAA record...

CVE-2012-5689: Improper Input Validation

ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote attackers to cause a denial of service assertion failure and named daemon exit via a query for an AAAA record...

Cache: NonManagedConnectionFactory will log password in clear text when an exception occurs

The NonManagedConnectionFactory in JBoss Enterprise Application Platform EAP 5.1.2 and 5.2.0, Web Platform EWP 5.1.2 and 5.2.0, and BRMS Platform before 5.3.1 logs the username and password in cleartext when an exception is thrown, which allows local users to obtain sensitive information by readi...

Long-awaited HIPAA Omnibus Rule is Unveiled

As of January 17, 2013, the HIPAA Omnibus Rule has finally been released by the Department of Health and Human Services HHS, which will modify the HIPAA privacy, security, and enforcement rules. The package of regulations, in regard to this long-overdue HIPAA Omnibus Rule, will officially be post...

CVE-2012-4528: Undefined Security Weakness

The modsecurity2 module before 2.7.0 for the Apache HTTP Server allows remote attackers to bypass rules, and deliver arbitrary POST data to a PHP application, via a multipart request in which an invalid part precedes the crafted data...

PT-2012-5461

Name of the Vulnerable Software and Affected Versions mod security2 versions prior to 2.7.0 Description The issue allows remote attackers to bypass rules and deliver arbitrary POST data to a PHP application via a multipart request where an invalid part precedes the crafted data. This can be...

University of Michigan Health Systems Admits Patient Data Stolen

UPDATE – Some 4,000 University of Michigan Health Systems patients had their medical data compromised last month when a vendor’s laptop containing medication log files was stolen from a vehicle. That medication management provider, Mountain View, Calif.-based Omnicell, admits it violated both its...

Fedora 17 : openvswitch-1.4.2-5.fc17 (2012-17477)

Don't create world-writable pki//incoming directory Don't add iptables accept rule for -p GRE as GRE tunneling is unsupported Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean a...

[360-FAAR] Firewall Analysis Audit And Repair 0.3.6

360-FAAR Firewall Analysis Audit and Repair is an offline, command line, Perl firewall policy manipulation tool to filter, compare to logs, merge, translate and output firewall commands for new policies, in Checkpoint dbedit, Cisco ASA or ScreenOS commands, and its one file! Read Policy and Logs...

ModSecurity 2.6.8 Bypass

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: ModSecurity multipart/invalid part ruleset bypass product: ModSecurity vulnerable version: = 2.6.8 fixed version: 2.7.0 CVE number: - impact: Depends what you use it for...

Arbitrary resource file download in urlrewrite.xml

panel:bgColor=e7f4fa NOTE: This bug report is for Confluence Server. Using Confluence Cloud? See the corresponding bug report|http://jira.atlassian.com/browse/CONFCLOUD-26888. panel There is an arbitrary resource file download vulnerability triggered by a third party library...

Asterisk Peer IAX2 Call Handling ACL Rule Bypass (AST-2012-013)

According to the version in its SIP banner, the version of Asterisk running on the remote host is potentially affected by a vulnerability that could allow a remote, authenticated attacker to bypass access controls on out-bound calls. Inter-Asterisk eXchange IAX2 out-bound call restrictions can be...

PT-2012-5564

Name of the Vulnerable Software and Affected Versions Asterisk Open Source versions 1.8.x through 1.8.15.0 Asterisk Open Source version 10.x through 10.7.0 Certified Asterisk versions 1.8.11 through 1.8.11-cert6 Asterisk Digiumphones versions 10.x.x-digiumphones through 10.7.0-digiumphones Asteri...

owasp-modsecurity-crs

!Travis build v3.3/devhttps://img.shields.io/travis/spiderlab...

Senator Seeks to Strengthen SEC-Required Cybercrime Reporting

U.S. Sen. Jay Rockefeller wants to strengthen SEC legislation that requires publicly traded companies disclose significant digital security breaches, mainly because most aren’t. The chairman of the Senate Commerce, Science and Transportation Committee last week added a provision to cybersecurity...

CVE-2011-0006: Undefined Security Weakness

The imalsmruleinit function in security/integrity/ima/imapolicy.c in the Linux kernel before 2.6.37, when the Linux Security Modules LSM framework is disabled, allows local users to bypass Integrity Measurement Architecture IMA rules in opportunistic circumstances by leveraging an administrator's...

MDVA-2012:044 : timezone

Timezone is a package that contains data files with rules for various timezones around the world. This update addresses the following changes: - Fiji adopts DST for 2011 effective Oct 23rd, 2011 - West Bank changes date for DST end in 2011 to Sep 30th - Fix DST for: Pridnestrovian Moldavian...