tomcat: Multiple weaknesses in HTTP DIGEST authentication

The HTTP Digest Access Authentication implementation in Apache Tomcat 5.5.x before 5.5.34, 6.x before 6.0.33, and 7.x before 7.0.12 does not check realm values, which might allow remote attackers to bypass intended access restrictions by leveraging the availability of a protection space with weak...

Ubuntu 10.04 LTS : linux vulnerabilities (USN-1445-1)

A flaw was found in the Linux's kernels ext4 file system when mounted with a journal. A local, unprivileged user could exploit this flaw to cause a denial of service. CVE-2011-4086 A flaw was found in the Linux kernel's KVM Kernel Virtual Machine virtual cpu setup. An unprivileged local user coul...

kernel: fcaps: clear the same personality flags as suid when fcaps are used

The capbprmsetcreds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities aka fcaps for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted applicatio...

Comodo Internet Ssecurity DoS

BSOD on PE execution if ImageBase points to kernel space...

admin/fixCaseInSpacePermissions.jsp lacks an XSRF token to 'fix the case of your space permissions'

admin/fixCaseInSpacePermissions.jsp does not require a csrf token to 'fix the case of your space permissions'. When fixing this issue, please ensure that the JSP is converted to an action or deleted - we don't want to have to maintain our XSRF infrastructure in JSPs...

Legacy Native Malware in Angry Birds Space to pwn your Android !

Legacy Native Malware in Angry Birds Space to pwn your Android A new malware threatens phones and tablets running Google's OS by hiding inside a copy of the popular game. Researchers at the mobile security firm Lookout identified the reworked malware as Legacy Native LeNa, which poses as a...

Разработка эксплоитов для Linux. Часть 4 – обход ASCII armor и возврат в plt

Автор: sickness Блог автора: Перевод: Gh0St 07.04.2012 Разработка эксплоитов для Linux. Часть 4 – обход ASCII armor и возврат в plt. ПРИМЕЧАНИЕ: Перед чтением данного документа, рекомендуется ознакомиться со следующими работами: Руководство по написанию эксплоитов для Linux. Часть I – переполнени...

The Pirate Bay Buys Greek Airspace for Launching Low Orbit Server Drones

The Pirate Bay Buys Greek Airspace for Launching Low Orbit Server Drones Few days back we reported that, One of the world's largest BitTorrent sites "The Pirate Bay" is going to put servers on GPS-controlled aircraft drones in order to evade authorities who are looking to shut the site down. Most...

Customer Credit Reports for Resale in Black market

Customer Credit Reports for Resale in Black market Internet security concerns grew the most, Approximately half of respondents said they were seriously concerned about viruses, spam, and the safety of online shopping. 70% of respondents said they were seriously concerned about identity theft, and...

CVE-2012-1572

OpenStack Keystone: extremely long passwords can crash Keystone by exhausting stack space...

Moderate: Red Hat Security Advisory: rhevm security and bug fix update

Updated rhevm packages that fix one security issue and various bugs are now available. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the...

Asterisk - 'ast_parse_digest()' Stack Buffer Overflow (PoC)

=========================== Description =========================== There is a remotely exploitable stack buffer overflow in HTTP digest authentication handling in Asterisk. This vulnerability includes the possibility of code execution with plenty of stack space for inserting custom code to run. ...

THE "TRUTH" SIMMERS THE POT OF SABU

THE "TRUTH" SIMMERS THE POT OF SABU By: Patti Galle, Editor THN. As I look at my guy fawkes mask and reflect on the recent arrest of several lulzsec members, I have a wrenching feeling in my gut to tell the "truth." Gather around anonymous, lulzsec, FBI, passionate supporters, liberal haters, and...

Ubuntu 8.04 LTS : linux vulnerabilities (USN-1390-1)

Dan Rosenberg reported errors in the OSS Open Sound System MIDI interface. A local attacker on non-x86 systems might be able to cause a denial of service. CVE-2011-1476 Dan Rosenberg reported errors in the kernel's OSS Open Sound System driver for Yamaha FM synthesizer chips. A local user can...

NASA Computers Hacked Repeatedly in Last Two Years

NASA has been hit repeatedly by hackers during the last two years – including an incident where attackers compromised systems at the agency’s Jet Propulsion Laboratory. The situation was revealed in testimony Feb. 29 by NASA Inspector General Paul Martin before the House Science, Space and...

busybox security and bug fix update

1:1.2.0-13 - Resolves: 768083 'busybox various flaws' including: 'buffer underflow in decompression' 'udhcpc insufficient checking of DHCP options' 1:1.2.0-12 - Resolves: 756723 'Kdump fails after findfs subcommand of busybox fails' 1:1.2.0-11 - Resolves: 689659 ''busybox cp' does not return a...

Space Pioneers 2 Game Detected

Binary data 6241.prm...

[SECURITY] Fedora 16 Update: glibc-2.14.90-24.fc16.6

The glibc package contains standard libraries which are used by multiple programs on the system. In order to save disk space and memory, as well as to make upgrading easier, common system code is kept in one place and shared between programs. This particular package contains the most important se...

Analyzing ASLR in Android Ice Cream Sandwich 4.0

When I first saw the release notes for the new Android Ice Cream Sandwich ICS platform, I was excited to see that Google mentioned that “Android 4.0 now provides address space layout randomization”. For the uninitiated, ASLR randomizes where various areas of memory eg. stack, heap, libs, etc are...

RedHat Update for squirrelmail RHSA-2012:0103-01

Check for the Version of squirrelmail OpenVAS Vulnerability Test RedHat Update for squirrelmail RHSA-2012:0103-01 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...