Amazon Linux AMI : httpd24 / httpd (ALAS-2017-896) (Optionsbleed)

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. The attacker sends an unauthenticated OPTIONS HTTP request when attempting to read secret...

ALPINE-CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user’s .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

UBUNTU-CVE-2017-9798

Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. This affects the Apache HTTP Server through 2.2.34 and 2.4.x through 2.4.27. The attacker...

Important: httpd24, httpd

Issue Overview: Apache httpd allows remote attackers to read secret data from process memory if the Limit directive can be set in a user's .htaccess file, or if httpd.conf has certain misconfigurations, aka Optionsbleed. The attacker sends an unauthenticated OPTIONS HTTP request when attempting t...

Ruby: Arbitrary heap overread in strscan on 32 bit Ruby, patch included

ruby require 'strscan' x = 'x' 0x7FFFFFFE s = StringScanner.newx s.pos = 0x7FFFFFFD t = s.peek40000 t.eachbyte do |i| if i != 0 print i.chr end end Run: sh ./ruby r.rb | strings My output: @ ;@VTdBE...

Microsoft Sues US Govt Over Unconstitutional Secret Data Requests

Microsoft is suing the Department of Justice DoJ to protest the gag order that prevents technology companies from telling their customers when their cloud data is handed over to authorities. In layman's terms, the Electronic Communications Privacy Act ECPA allows the government to issue gag order...

Improper validation of certificates when using self-signed certificates - ownCloud

The ownCloud Desktop Client was vulnerable against MITM attacks until version 2.0.0 in combination with self-signed certificates. To be exploitable the following conditions have to be met: The connection to the remote ownCloud server must be secured using a self-signed certificate which the user...

Academics Use Siri to Move Secrets Off Jailbroken iOS Device

Attackers living on any network are all about one thing: persistence. They want to get on quietly and stay on quietly. But what about moving stolen data off a network? How quiet can that be? Two researchers believe they’ve figured out a way to combine Siri, Apple iOS’ native voice-activated...

NSA Crypto Questions Resemble a 'Hall of Mirrors'

There’s been no shortage of discussion and debate in recent week about the possibility that the NSA has intentionally weakened some cryptographic algorithms and cipher suites in order to give it an advantage in its intelligence-gathering operations. If you subscribe to the worst-case scenario lin...

UK Ministry of Defence: Hackers Have Breached Top Secret Systems

The UK’s military’s head of cyber security warned that hackers have breached computer systems containing top secret data, The Guardian reported. Major General Jonathan Shaw told the paper that the number of known breaches to top secret systems was small, but that attacks were “hard to quantify” a...

nCipher Advisory #9: Host-side attackers can access secret data

nCipher Security Advisory No. 9 Host-side attackers can access secret data ------------------------------------------ SUMMARY ======= On certain models and firmware combinations, an attacker who is able to issue commands to an HSM eg, by having use or control of the host to which it is connected...