CVE-2014-0488

APT before 1.0.9 does not "invalidate repository data" when moving from an unauthenticated to authenticated state, which allows remote attackers to have unspecified impact via crafted repository data...

CVE-2014-0487

APT before 1.0.9 does not verify downloaded files if they have been modified as indicated using the If-Modified-Since header, which has unspecified impact and attack vectors...

CVE-2014-0489

APT before 1.0.9, when the Acquire::GzipIndexes option is enabled, does not validate checksums, which allows remote attackers to execute arbitrary code via a crafted package...

Citadel Used in Attacks Against Petrochemical Companies

Cybercrime tools continue to crossover into the realm of nation-state targeted attacks, with the latest example being a variant of the Citadel banking Trojan used in attacks against petrochemical companies in the Middle East. The attacks took place within the past few months, said researchers at...

DSA-3025-1 apt - security update

Bulletin has no description...

Debian Security Advisory DSA 3025-1 (apt - security update)

It was discovered that APT, the high level package manager, does not properly invalidate unauthenticated data CVE-2014-0488, performs incorrect verification of 304 replies CVE-2014-0487, does not perform the checksum check when the Acquire::GzipIndexes option is used CVE-2014-0489 and does not...

DLA-53-1 apt - security update

Bulletin has no description...

Debian: Security Advisory (DSA-3025-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Chinese Groups Found Targeting Govt, Military Systems

Two Chinese cyber espionage campaigns are working in tandem in hopes of sniffing out trade secrets from surrounding nations. Researchers from FireEye outlined information about the two attack groups yesterday in advance of a more comprehensive report. One of the groups, Moafree, operates out of t...

Debian Security Advisory DSA 3020-1 (acpi-support - security update)

During a review for EDF, Raphael Geissert discovered that the acpi-support package did not properly handle data obtained from a user OpenVAS Vulnerability Test $Id: deb3020.nasl 6735 2017-07-17 09:56:49Z teissa $ Auto-generated from advisory DSA 3020-1 using nvtgen 1.0 Script version: 1.0 Author:...

Debian Security Advisory DSA 3021-1 (file - security update)

Multiple security issues have been found in file, a tool to determine a file type. These vulnerabilities allow remote attackers to cause a denial of service, via resource consumption or application crash. OpenVAS Vulnerability Test $Id: deb3021.nasl 6750 2017-07-18 09:56:47Z teissa $ Auto-generat...

Debian Security Advisory DSA 2940-1 (libstruts1.2-java - security update)

It was discovered that missing access checks in the Struts ActionForm object could result in the execution of arbitrary code. OpenVAS Vulnerability Test $Id: deb2940.nasl 6759 2017-07-19 09:56:33Z teissa $ Auto-generated from advisory DSA 2940-1 using nvtgen 1.0 Script version: 1.0 Author:...

Looking Ahead to MIRcon 2014

As targeted cyber attacks become increasingly prevalent, today's cybersecurity professionals are being tested like never before. The upcoming Mandiant Incident Response Conference MIRcon® - October 7 & 8, 2014 - offers attendees the chance to hear insights from some of the most respected and...

Heartbleed Exploit Linked to Community Health Data Breach

Update: The Heartbleed OpenSSL vulnerability is now the centerpiece of the Community Health Systems data breach. Dave Kennedy, CEO of security consultancy TrustedSec, said yesterday that three sources close to the CHS investigation told him that a Heartbleed exploit was the hackers’ initial way i...

Debian Security Advisory DSA 3007-1 (cacti - security update)

Multiple security issues cross-site scripting, missing input sanitising and SQL injection have been discovered in Cacti, a web interface for graphing of monitoring systems. OpenVAS Vulnerability Test $Id: deb3007.nasl 6750 2017-07-18 09:56:47Z teissa $ Auto-generated from advisory DSA 3007-1 usin...

Community Health Systems APT Data Breach Medical Espionage

At first blush, the Community Health Systems data breach by Chinese hackers seems to be an anomaly. State-sponsored attackers generally target intellectual property for the purposes of military or economic gain; stealing healthcare credentials and personal patient records seems incongruous. But...

Epic Operation Kicks Off Multistage Turla APT Campaign

The Turla APT campaign has baffled researchers for months as to how its victims are compromised. Peaking during the first two months of the year, Turla has targeted municipal governments, embassies, militaries and other high-value targets worldwide, with particular concentrations in the Middle Ea...

Crouching Yeti APT Campaign Stretches Back Four Years

A new analysis of a long-term APT campaign targeting manufacturers, industrial, pharmaceutical, construction and IT companies in several countries has uncovered fresh details of the attack, including identification of nearly 3,000 victims and the unmasking of the command-and-control infrastructur...

Debian Security Advisory DSA 2983-1 (drupal7 - security update)

Multiple security issues have been discovered in the Drupal content management system, ranging from denial of service to cross-site scripting. More information can be found at https://www.drupal.org/SA-CORE-2014-003 . OpenVAS Vulnerability Test $Id: deb2983.nasl 8972 2018-02-28 07:02:10Z cfischer...

Fedora Update for apt-cacher-ng FEDORA-2014-7751

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...