Vulnerability in SMBv2 Could Allow Remote Code Execution (942624)

This host is missing a critical security update according to Microsoft Bulletin MS07-063. OpenVAS Vulnerability Test $Id: gbms07-063.nasl 5362 2017-02-20 12:46:39Z cfi $ Vulnerability in SMBv2 Could Allow Remote Code Execution 942624 Authors: Madhuri D Copyright: Copyright c 2011 Greenbone Networ...

TDL4 Rootkit Bypasses Windows Code-Signing Protection

In recent versions of Windows, specifically Vista and Windows 7, Microsoft has introduced a number of new security features designed to prevent malicious code from running. But attackers are continually finding new ways around those protections, and the latest example is a rootkit that can bypass...

New Safari Bug Being Used to Jailbreak iPhones

A Web site set up to help iPhone users jailbreak their devices is using a flaw in the way that the iPhone handles PDF files to escape the phone’s sandbox security function and enable users to load applications that aren’t in Apple’s official App Store. The same flaw could easily be used to instal...

Microsoft .Net XML signing protection bypass

Only part of signature is compared in case of incomplete HMAC...

Facebook Developer Verification Won't Stop Rogue Apps

Looking to clamp down on the escalation of malicious apps on its popular social network, Facebook will now require that every developer to verify their Facebook account by providing a mobile phone number or adding a credit card to their account. While this is clearly a step in the right direction...

IT-Grundschutz M4.334: SMB Message Signing und Samba

IT-Grundschutz M4.334: SMB Message Signing und Samba ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94241 Diese Prüfung bezieht sich auf die 11. Ergänzungslieferung 11...

IT-Grundschutz M4.334: SMB Message Signing und Samba

IT-Grundschutz M4.334: SMB Message Signing und Samba ACHTUNG: Dieser Test wird nicht mehr unterstützt. Er wurde ersetzt durch den entsprechenden Test der nun permanent and die aktuelle EL angepasst wird: OID 1.3.6.1.4.1.25623.1.0.94241 Diese Prüfung bezieht sich auf die 11. Ergänzungslieferung 11...

iPhone Sandbox Model Not Enough

The iPhone sandbox has always been held up as a major roadblock to thwart hackers from doing damage on the device. But, as European researchers Vincenzo Iozzo and Ralf Philipp Weinmann proved, a hacker can hijack a lot of sensitive data without ever leaving the iPhone sandbox. In this case, they...

Aladdin eToken PKI Client 4.5 - Virtual File Handling Memory Corruption (PoC)

Aladdin eToken PKI Client 4.5 - Virtual File Handling Memory Corruption PoC !/usr/bin/perl -w Title: Aladdin eToken PKI Client v4.5 Virtual File Handling Unspecified Memory Corruption PoC Summary: The eToken PKI Client is the software that enables eToken USB operation and the implementation of...

Aladdin eToken PKI Client 4.5 - Virtual File Handling Memory Corruption (PoC)

!/usr/bin/perl -w Title: Aladdin eToken PKI Client v4.5 Virtual File Handling Unspecified Memory Corruption PoC Summary: The eToken PKI Client is the software that enables eToken USB operation and the implementation of eToken PKI-based solutions. These solutions include certificate-based strong...

iPhone Hacked at Pwn2Own; SMS Database Stolen

VANCOUVER, BC — A pair of European researchers used the spotlight of the CanSecWest Pwn2Own hacking contest here to break into a fully patched iPhone and hijack the entire SMS database, including text messages that had already been deleted. Using an exploit against a previously unknown...

For Kaspersky 2 0 1 0 the free kill study-vulnerability warning-the black bar safety net

Article author: chinafe For Kaspersky 2 0 1 0free to killresearch Kaspersky 2 0 1 0 for digital signing and System File Protection becomes very strict, the registry does not say that after so many years the upgrade is basically no use value, Kaspersky 2 0 1 0 the previous version can modify the...

Code injection

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just...

CVE-2009-3474

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just...

DEBIAN-CVE-2009-3474

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just...

CVE-2009-3474

OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just...

RHEL 4 / 5 : java-1.5.0-sun (RHSA-2007:0963)

Updated java-1.5.0-sun packages that correct several security issues are now available for Red Hat Enterprise Linux 4 Extras and 5 Supplementary. This update has been rated as having important security impact by the Red Hat Security Response Team. The Java Runtime Environment JRE contains the...

CVE-2008-6909

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges...

CVE-2008-6909

Services 5.x before 5.x-0.92 and 6.x before 6.x-0.13, a module for Drupal, does not sign all required data in requests, which has unspecified impact, probably related to man-in-the-middle attacks that modify critical data and allow remote attackers to impersonate other users and gain privileges...

ATEN IP KVM Switches multiple cryptographic vulnerabilities

Same SSL certificate is used for all devices, static symmetric key is used for code signing, mouse events are not encrypted, predictable session key is used...