ntpd DRDoS / Amplification Attack using ntpdc monlist command

ntp.org reports: Unrestricted access to the monlist feature in ntprequest.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service traffic amplification via forged 1 REQMONGETLIST or 2 REQMONGETLIST1 requests, as exploited in the wild in December 2013 Use noquery to...

Fedora 19 : boinc-client-7.2.33-2.git1994cc8.fc19 (2013-23720)

Updates Boinc to 7.2.33. Remove the 'Can't connect to boinc-client' notify at startup. Fix 'GPU not detected' problem. Fix security vulnerability 957811 Please note for 'GPU not detected' bug If you still have this problem after updating, you need to run boinc with your user, not with boinc user...

OpenStack: Keystone disabling a tenant does not disable a user token

OpenStack Identity Keystone Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token...

PT-2013-5035 · Red Hat · Red Hat Satellite

Name of the Vulnerable Software and Affected Versions: Red Hat Satellite versions 5.6 and earlier Description: The issue allows remote attackers to create administrator accounts due to the web interface not being disabled. Recommendations: For Red Hat Satellite versions 5.6 and earlier, disable t...

PT-2013-1076 · Pixman +4 · Pixman +4

Name of the Vulnerable Software and Affected Versions: pixman versions prior to 0.32.0 pixman version 0.22.0 Description: The issue is related to an integer underflow in the pixman trapezoid valid macro in pixman.h in Pixman, which can be exploited to cause a denial of service crash via a negativ...

Juniper Junos J-Web - Privilege Escalation

Juniper Junos J-Web - Privilege Escalation Sense of Security - Security Advisory - SOS-13-003 security advisory Release Date. 10-Sep-2013 Last Update. - Vendor Notification Date. 27-Sep-2012 Product. Juniper Junos J-Web Platform. Junos Affected versions. All builds prior to 2013-02-28 are affecte...

FreeBSD : OpenSSH -- Memory corruption in sshd (5709d244-4873-11e3-8a46-000d601460a4)

The OpenSSH development team reports : A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. If exploited, this vulnerability might permit code execution with the...

OpenSSH -- Memory corruption in sshd

The OpenSSH development team reports: A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. If exploited, this vulnerability might permit code execution with the...

Internet Bug Bounty: OpenSSH: Memory corruption in AES-GCM support

Vulnerability A memory corruption vulnerability exists in the post- authentication sshd process when an AES-GCM cipher [email protected] or [email protected] is selected during kex exchange. If exploited, this vulnerability might permit code execution with the privileges of the...

Tiki Wiki CMS Groupware vulnerable to SQL injection

Overview Tiki Wiki CMS Groupware Tiki is a content management system CMS. Tiki contains a SQL injection vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An arbitrary SQL...

java-1.6.0-openjdk security update

1:1.6.0.0-1.68.1.11.14 - updated to icedtea6-1.11.14.tar.gz - added and applied 1.11.14-fixes.patch, patch10 to fix build issues - adapted patch8 java-1.6.0-openjdk-timezone-id.patch - Resolves: rhbz1017618 1:1.6.0.1-1.67.1.13.0 - reverted previous update - Resolves: rhbz1017618...

[SterJo Startup Patrol v.1.3] Disable software that delayed the boot time

Often may happen your PC to run a little slower than usual. Don't worry, it is nothing serious. You’ve probably installed some software that delayed the boot time. SterJo Startup Patrol allows you to view those files and disable them. This way you can optimize the Windows startup time but be...

[IPv6 Disable Tool] Command-line Software to Enable or Disable IPv6 on Windows

IPv6 Disable is the free command-line tool to quickly Enable or Disable IPv6 Internet Protocol version 6 on your Windows system. It automatically checks for the current status of IPv6 and then enable/disable it accordingly. It is simple & easy to use tool. Also being a command-line based tool mak...

October 2013 Oracle Java Critical Patch Update

On Tuesday, for the first time, Java security updates were included with the quarterly Oracle Critical Patch Update – and just as quickly, Java wasted no time elevating itself as the top concern for Oracle admins and security experts. Of the 51 Java patches released, 50 allow for remote code...

PT-2013-5594 · Cisco · Cisco Asa

Name of the Vulnerable Software and Affected Versions: Cisco Adaptive Security Appliance ASA Software versions 7.x through 7.25.11 Cisco Adaptive Security Appliance ASA Software versions 8.x through 8.25.45 Cisco Adaptive Security Appliance ASA Software versions 8.3.x through 8.32.38 Cisco Adapti...

DEBIAN-CVE-2013-4222

OpenStack Identity Keystone Folsom, Grizzly 2013.1.3 and earlier, and Havana before havana-3 does not properly revoke user tokens when a tenant is disabled, which allows remote authenticated users to retain access via the token...

Upgrade Attack

Added: 09/30/2013 Background The LLMNR Local Link Multicast Name Resolution protocol is used to answer wpad requests sent by Microsoft Windows. A rogue WPAD server delivers a wpad.dat file to poisoned hosts forcing them to proxy web requests through the SAINT server. In addition, HTTP requests ar...

WPAD Listener

Added: 09/30/2013 Background The LLMNR Local Link Multicast Name Resolution protocol is used to answer wpad requests sent by Microsoft Windows. A rogue WPAD server delivers a wpad.dat file to poisoned hosts forcing them to proxy web requests through the SAINT server. In addition, browsers are...

Upgrade Attack

Added: 09/30/2013 Background The LLMNR Local Link Multicast Name Resolution protocol is used to answer wpad requests sent by Microsoft Windows. A rogue WPAD server delivers a wpad.dat file to poisoned hosts forcing them to proxy web requests through the SAINT server. In addition, HTTP requests ar...

disable XSRF check property has no effect on REST API

When disable the xsrf through the property in jira.xsrf.enabled=false in jira-config.properties according to the page|https://developer.atlassian.com/display/JIRADEV/Form+Token+Handling, it doesn't stop the xsrf checking when using JIRA REST API. However, the property took effect when you try som...