Novell BorderManager 3.0/3.5 Audit Trail Proxy DoS Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/976/info A feature called the CS Audit Trail Proxy is installed by default with BorederManager 3.0 and 3.5 .This feature opens a listening port at port 2000, on both the internal and external interfaces. If a connection i...

Crowdsourcing a Tool for Application Vulnerability Research

Pulling in security help on a project has traditionally meant either hiring more full-time help, or bringing in an outside consultant. Enterprises and vendors alike, however, are starting to really go outside the perimeter these days and are taking advantage of crowdsourcing. Given the paranoia i...

Design/Logic Flaw

arch/mips/include/asm/threadinfo.h in the Linux kernel before 3.14.8 on the MIPS platform does not configure TIFSECCOMP checks on the fast system-call path, which allows local users to bypass intended PRSETSECCOMP restrictions by executing a crafted application without invoking a trace or audit...

CVE-2014-4157

arch/mips/include/asm/threadinfo.h in the Linux kernel before 3.14.8 on the MIPS platform does not configure TIFSECCOMP checks on the fast system-call path, which allows local users to bypass intended PRSETSECCOMP restrictions by executing a crafted application without invoking a trace or audit...

Security fix for the ALT Linux 7 package kernel-image-el-def version 2.6.32-alt24

June 20, 2014 Led 2.6.32-alt24 - futex: Add another early deadlock detection check - futex: Prevent attaching to kernel threads - futex: Validate atomic acquisition in futexlockpiatomic - futex: Always cleanup owner tid in unlockpi - futex: Make lookuppistate more robust - auditsc: auditkrule mas...

Possible TrueCrypt Fork in the Works

Although the developers behind the TrueCrypt encryption software have given up the ghost and decided to no longer maintain the application, interest in the project has never been higher. But, one of the developers says that a nascent effort to fork TrueCrypt is unlikely to succeed. Matthew Green,...

YASAT - Yet Another Stupid Audit Tool

YASAT Yet Another Stupid Audit Tool is a simple stupid audit tool. Its goal is to be as simple as possible with minimum binary dependencies only sed, grep and cut Second goal is to document each test with maximum information and links to official documentation. It do many tests for checking...

openSUSE Security Update : jasper (openSUSE-SU-2011:1328-1)

Specially crafted JPEG2000 files could cause a heap buffer overflow in jasper CVE-2011-4516, CVE-2011-4517 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update jasper-5543. The text description of...

openSUSE Security Update : apache2 (openSUSE-2011-55)

specially crafted requests could bypass RewriteRule and ProxyPassMatch - new template file: /etc/apache2/vhosts.d/vhost-ssl.template allow TLSv1 only, browser match stuff commented out. - rc script /etc/init.d/apache2: handle reload with deleted binaries by message to stdout only, but refrain...

Audit Project Released Verified Repositories of TrueCrypt 7.1a

As the uncertainty surrounding the end of TrueCrypt continues, members of the security community are working to preserve a known-good archive of the last version of the open source encryption software released before the developers inserted a warning about potential unfixed bugs in the software a...

Fortify SCA analysis code vulnerabilities the whole solution-vulnerability warning-the black bar safety net

The last describes the use of FindBugs-assisted analysis of code vulnerability, this time a tools: Fortify SCA Demo 4.0.0。 Fortify is a security aspect of the quite famous company, there is not much to say. First introduce the protagonist: the Fortify SCA Demo 4.0.0, although do not know now...

DEBIAN-CVE-2014-3917

kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIGAUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service OOPS via a large value of a syscall number...

UBUNTU-CVE-2014-3917

kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIGAUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service OOPS via a large value of a syscall number...

Fedora 19 : smb4k-1.1.2-1.fc19 (2014-6255)

New upstream release. Update to Smb4K 1.1.1, the first bug fix release of the stable 1.1 branch. This release fixes a crash bug and a potential security issue Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has...

Crowdsourcing to be Part of Phase Two of TrueCrypt Audit

TrueCrypt may yet get forked, but it won’t come at the hands of the Open Crypto Audit Project OCAP, which has a working plan to move forward with a cryptanalysis of the open source encryption software. OCAP is the brand name for the grassroots movement that arose out of the ashes of the Snowden...

Of TrueCrypt and the Warrant Canary

Apple’s first transparency report, released last November, was one in a string of many released following the start of the Snowden leaks by technology companies trying to distance themselves from the tentacles of NSA surveillance. Apple’s report, however, contained two sentences that made it stan...

OpenSSL Receives Funding for Developers, Will Undergo Security Audit

Scarcely a month after announcing the formation of a group designed to help fund open source projects, the Core Infrastructure Initiative has decided to provide the OpenSSL Project with enough money to hire two full-time developers and also will fund an audit of OpenSSL by the Open Crypto Audit...

FineCMS v1.8任意文件下载

简要描述： 代码审计是个技术活，需要很好的耐心.. o︶︿︶o 详细说明： 出现问题的版本是FineCMS V1.8.0 最新版。 1.顺藤摸瓜 漏洞文件：controllers/ApiController.php downAction方法 public function downAction $data = fnauthcodebase64decode$this-get'file', 'DECODE'; $file = isset$data'finecms' && $data'finecms' ? $data'finecms' : ''; if empty$file...

TrueCrypt Warns Software 'Not Secure,' Development Shut Down

Is it a hoax, or the end of the line for TrueCrypt? At the moment, there is little more than speculation as to the appearance today of an ominous note greeting visitors to the TrueCrypt page at SourceForge. The text warns that the open source encryption software is not secure and informs users th...

JBossSX/PicketBox: World readable audit.log file

It was found that the security auditing functionality provided by PicketBox and JBossSX, both security frameworks for Java applications, used a world-readable audit.log file to record sensitive information. A local user could possibly use this flaw to gain access to the sensitive information in t...