Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with the security standards and regulations that are most commonly used and adhered to. Qualys provides a wide range of policies, including many that have been certified by CIS as well as the ones based on security guidelines from vendo...

Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with commonly adhered to security standards and regulations. Qualys provides a wide range of policies, including many that have been certified by CIS as well as ones based on security guidelines from vendors such as Microsoft and VMware...

System Integrity Management Platform: SIMP

System Integrity Management Platform The System Integrity Management Platform SIMP is an Open Source framework designed around the concept that individuals and organizations should not need to repeat the work of automating the basic components of their operating system infrastructure. Expanding...

Portable Virtual Private Network: goSecure

Portable Virtual Private Network goSecure is an easy to use and portable Virtual Private Network VPN solution. The system consists of a single server and one or many clients. strongSwan is used to establish a Suite B IPsec tunnel with pre-shared keys between the server and clients. The core crypt...

Qualys Policy Compliance Notification: Policy Library Update

Qualys’ library of built-in policies makes it easy to comply with commonly adhered to security standards and regulations. Qualys provides a wide range of policies, including many that have been certified by CIS as well as ones based on security guidelines from vendors such as Microsoft and VMware...

Disa - Corrupted files, Exported components, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Disa published at the 'play' market has multiple vulnerabilities...

Systems Integrity Management Platform – SIMP

The System Integrity Management Platform SIMP is an Open Source framework designed around the concept that individuals and organizations should not need to repeat the work of automating the basic components of their operating system infrastructure. Expanding upon this philosophy, SIMP also aims t...

DISA Security Readiness Review Scripts Detection

The remote host has a copy of the DISA Security Readiness Review SRR Scripts present. TRUSTED...

[SecureCheq v1.0] The Security Configuration Management made easy!

SecureCheq is a fast, simple utility for Windows servers and desktops that answers these questions while it tests for common configuration risks. This free utility: Tests for a subset of typical and often dangerous Windows configuration errors Provides detailed remediation and repair advice Tests...

THE CRAZIES Hackers Leaks Server Certificates of Defense Information Systems Agency (DISA)

THE CRAZIES Hackers Leaks Server Certificates of Defense Information Systems Agency DISA THE CRAZIES Hackers steal the Several Certificate revocation lists CRLs from Server of Defense Information Systems Agency DISA - and leak the Certificates at : Reason of Hacking is Freedom of Libyan nation,...

DISA STIG SRR Still Vulnerable

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 After the issue in CVE-2009-4211 was made public, the Unix SRR script was removed from http://iase.disa.mil/stigs/SRR/unix.html with a note saying: ?Due to a recently identified security issue, please do not run any version of the UNIX SRR scripts unt...

UPDATE: DISA Unix SRR root compromise / CVE-2009-4211 / VU#433821

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 After the issue in CVE-2009-4211 was made public, the Unix SRR script was removed from http://iase.disa.mil/stigs/SRR/unix.html with a note saying: ?Due to a recently identified security issue, please do not run any version of the UNIX SRR scripts unt...

DISA UNIX SRR scripts execute untrusted programs as root

Overview The Defense Information Systems Agency DISA UNIX Security Readiness Review SRR scripts find1 and execute -exec various programs to obtain version information. The SRR scripts are designed to be run as root. An attacker who can write a file under the root file system may be able to exploi...

Code injection

The U.S. Defense Information Systems Agency DISA Security Readiness Review SRR script for the Solaris x86 platform executes files in arbitrary directories as root for filenames equal to 1 java, 2 openssl, 3 php, 4 snort, 5 tshark, 6 vncserver, or 7 wireshark, which allows local users to gain...

CVE-2009-4211

The U.S. Defense Information Systems Agency DISA Security Readiness Review SRR script for the Solaris x86 platform executes files in arbitrary directories as root for filenames equal to 1 java, 2 openssl, 3 php, 4 snort, 5 tshark, 6 vncserver, or 7 wireshark, which allows local users to gain...

CVE-2009-4211

The U.S. Defense Information Systems Agency DISA Security Readiness Review SRR script for the Solaris x86 platform executes files in arbitrary directories as root for filenames equal to 1 java, 2 openssl, 3 php, 4 snort, 5 tshark, 6 vncserver, or 7 wireshark, which allows local users to gain...

CVE-2009-4211

CVE-2009-4211 arises from the DISA UNIX Security Readiness Review (SRR) scripts for Solaris x86, where SRR’s find(-exec) logic executes programs in root context if files are named one of: java, openssl, php, snort, tshark, vncserver, or wireshark. This enables a local attacker with filesystem acc...

U.S. Defense Information Systems Agency (DISA) Unix Security Readiness Review (SRR) root compromise / VU#433821

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Executive Summary - ----------------- Unprivileged local users can obtain root access on Unix systems where the DISA SRR scripts are run. If a remote user can introduce a file into the filesystem e.g. anonymous ftp, http upload, cdrom, samba share,...

DISA SRR Root Compromise

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Executive Summary - ----------------- Unprivileged local users can obtain root access on Unix systems where the DISA SRR scripts are run. If a remote user can introduce a file into the filesystem e.g. anonymous ftp, http upload, cdrom, samba share,...