EncFS 1.6.0 - Flawed CBC/CFB Cryptography Implementation

source: https://www.securityfocus.com/bid/42779/info EncFS is prone to design errors in its cryptographic implementation. Three flaws have been identified that contribute to a weakening of the protections provided under CBC/CFB cipher mode. Attackers may leverage these weaknesses to attack...

Major Browser Flaws Will Be In Spotlight At Black Hat

At next week’s Black Hat security conference, researcher Jeremiah Grossman plans to detail critical weaknesses that are enabled by default in major browsers–IE, Safari, Firefox and Chrome– and include vulnerabilities that have yet to be purged by the respective browser makers despite months and...

Pirate Bay Hack Exposes 4 Million Users

Security weaknesses in the hugely popular file-sharing Web site thepiratebay.org have exposed the user names, e-mail and Internet addresses of more than 4 million Pirate Bay users. Read the full article. KrebsonSecurity...

The Importance of Patching Human Vulnerabilities

Today’s threat landscape is very complex. Cybercriminals use a wide range of threats to hijack people’s computers and to make money illegally. These threats include Trojans of many different kinds, worms, viruses and exploit code which is designed to enable malware to make use of vulnerabilities ...

Government Says IRS Systems Still Risky

With tax time rapidly approaching, the U.S. Internal Revenue Service still has not sealed up all of the holes that could allow insiders or external hackers to access taxpayer data, according to a new report. The Government Accountability Office states that the IRS has corrected less than one-thir...

[Backports-security-announce] Security Update for drupal6

Luigi Gangitano uploaded new packages for drupal6 which fixed the following security problems: SA-CORE-2010-001 Multiple vulnerabilities and weaknesses were discovered in Drupal. Installation cross site scripting A user-supplied value is directly output during installation allowing a malicious us...

Social Pen Testers Highlight Gullible Users

Security B-Sides: Security penetration testers Mike Bailey and Mike Murray rely plenty on attacks that exploit weaknesses in websites and servers, but their approach is better summed up by the famous phrase “There’s a sucker born every minute.” Read the full article. The Register...

Design/Logic Flaw

Multiple unspecified vulnerabilities in HP Web Jetadmin 10.2, when a remote SQL server is used, allow remote attackers to obtain access to data or cause a denial of service, possibly by leveraging authentication and encryption weaknesses on the SQL server...

CVE-2009-4182

Multiple unspecified vulnerabilities in HP Web Jetadmin 10.2, when a remote SQL server is used, allow remote attackers to obtain access to data or cause a denial of service, possibly by leveraging authentication and encryption weaknesses on the SQL server...

CVE-2009-4182

HP Web Jetadmin 10.2 and later uses a remote SQL Server and is affected by multiple vulnerabilities that can allow remote unauthorized access to data and DoS. The root cause involves authentication and encryption weaknesses on the SQL server and insufficient network protections, per HP/SRT bullet...

Fedora Core 10 FEDORA-2009-12966 (rubygem-actionpack)

The remote host is missing an update to rubygem-actionpack announced via advisory FEDORA-2009-12966. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are...

The Root of the Botnet Epidemic

Over the course of a few days in February 2000, a lone hacker was able to bring some of the Web’s larger sites to their knees, using just a few dozen machines and some relatively primitive software to cripple Yahoo, eBay, Etrade, Amazon, ZDnet and others for hours at a time. No one knew it at the...

ContentKeeper Web Remote Command Execution

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'ContentKeepe...

Moxie Marlinspike on SSL Attacks

Dennis Fisher talks with researcher Moxie Marlinspike about the innovative research on attacking the inherent weaknesses in the SSL infrastructure that he presented at Black Hat, and the tools he has released to demonstrate the attacks, SSLSniff and SSLStrip. Download Subscribe to the Digital...

Microsoft Scrambling to Close Stubborn Security Hole

From Washington Post Brian Krebs Microsoft may soon be taking the unusual step of issuing an out-of-band security update to address multiple weaknesses that stem from a Windows security flaw that the software giant tried to fix earlier this month. Read the full story washingtonpost.com See more...

Robert "Rsnake" Hansen On Slowloris, DoS Attacks And RFC-1918 Networks

Dennis Fisher talks with Robert “Rsnake” Hansen about his Slowloris tool, low-bandwidth DoS attacks and the law of unintended consequences. Download SHOW NOTES: Mitigating the Slowloris HTTP DoS Attack New attack class exploits intranet weaknesses Subscribe to the Digital Underground podcast on...

Threatpost News Wrap #3: Patch releases, RFC1918 attack

Threatpost editors Ryan Naraine and Dennis Fisher discuss this week’s massive patch releases by Microsoft, Adobe and Apple, the RFC1918 attack paper by Robert Hansen and who they’d pick in a rotisserie hacker draft. Download SHOW NOTES: New attack class exploits intranet weaknesses The time has...

Multiple vulnerabilities in several ATEN IP KVM Switches

Jakob Lell from the TU Berlin computer security working group http://www.agrs.tu-berlin.de/v-menue/agrechnersicherheit/parameter/en/ has discovered multiple vulnerabilities in several ATEN IP KVM Switches. Affected products: - ATEN KH1516i IP KVM Switch browser firmware version 1.0.063 - ATEN...

Mandriva Update for smb4k MDKSA-2007:042 (smb4k)

Check for the Version of smb4k OpenVAS Vulnerability Test Mandriva Update for smb4k MDKSA-2007:042 smb4k Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the...

How to identify and clean Conficker infections

As the world prepares for the complete destruction of the Internet tomorrow when the Conficker worm makes a small change in its communication protocol, a voice of reason has emerged from the wilderness. The Honeynet Project on Monday released a paper with a detailed analysis of the worm as well a...