RSA Panel Review – Macs in the Enterprise

Managing IT for a software company has its challenges. For me, the lines between efficiency, security and innovation are difficult to draw at a company like nCircle where engineers require some freedom to perform their best. The panelists at the RSA session “Responding to the ignored threat – Mac...

The Importance of Internet Identity and Anonymity

Last year, Craig Mundie issued a call to arms for a more “trustworthy Internet” — not that Microsoft has been entirely successful at implementing its arguably more humble Trustworthy Computing initiative. But let’s not let the computing industry’s failure to bring forward operating systems, web...

Charney plugs Microsoft end-to-end trust at RSA Conference

Scott Charney used his keynote speech at the RSA Conference on Tuesday to talk up a variety of hardware and software-based technologies meant to infuse the Internet with more trust. Charney, the head of Microsoft’s Trustworthy Computing team, talked about the need for greater adoption of TPMs, co...

CVE-2009-1232

Mozilla Firefox 3.0.8 and earlier 3.0.x versions allows remote attackers to cause a denial of service memory corruption via an XML document composed of a long series of start-tags with no corresponding end-tags. NOTE: it was later reported that 3.0.10 and earlier are also affected...

CVE-2009-1234

Opera 9.64 allows remote attackers to cause a denial of service application crash via an XML document containing a long series of start-tags with no corresponding end-tags. NOTE: it was later reported that 9.52 is also affected...

Debian DSA-1753-1 : iceweasel -- end-of-life announcement for Iceweasel in oldstable

As indicated in the Etch release notes, security support for the Iceweasel version in the oldstable distribution Etch needed to be stopped before the end of the regular security maintenance life cycle. %NASLMINLEVEL 70300 This script was automatically generated from Debian Security Advisory...

DSA-1753-1 iceweasel - end-of-life announcement for iceweasel in oldstable

As indicated in the Etch release notes, security support for the Iceweasel version in the oldstable distribution Etch needed to be stopped before the end of the regular security maintenance life cycle. You are strongly encouraged to upgrade to stable or switch to a still supported browser. On a...

Moderate: Red Hat Security Advisory: evolution-data-server security update

Updated evolution-data-server and evolution28-evolution-data-server packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4 and 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Evolution Data Server provide...

RedHat Security Advisory RHSA-2009:0297

The remote host is missing updates announced in advisory RHSA-2009:0297. In accordance with the Red Hat Enterprise Linux Errata Support Policy, the 7 years life-cycle of Red Hat Enterprise Linux 2.1 will end on May 31 2009. After that date, Red Hat will discontinue the technical support services,...

RedHat Security Advisory RHSA-2009:0297

The remote host is missing updates announced in advisory RHSA-2009:0297. In accordance with the Red Hat Enterprise Linux Errata Support Policy, the 7 years life-cycle of Red Hat Enterprise Linux 2.1 will end on May 31 2009. After that date, Red Hat will discontinue the technical support services,...

ZABBIX PHP前端多个输入验证漏洞

BUGTRAQ ID: 33965 zabbix是一个CS结构的分布式网络监控系统。 ZABBIX的PHP前端存在多个输入验证错误，远程攻击者可以通过提交恶意请求执行跨站请求伪造攻击、读取敏感信息或完全入侵有漏洞的系统。 1 include/validate.inc.php中没有正确的过滤对calcexp2函数所提交的extlang参数，这可能导致注入并执行任意PHP代码。 2 由于没有检查用户提交请求的有效性，远程攻击者可以通过提交HTTP执行非授权操作。 3...

RHEL 2.1 : redhat-release (EOL Notice) (RHSA-2009:0297)

This is the 3-month notification of the End Of Life plans for Red Hat Enterprise Linux 2.1. In accordance with the Red Hat Enterprise Linux Errata Support Policy, the 7 years life cycle of Red Hat Enterprise Linux 2.1 will end on May 31 2009. After that date, Red Hat will discontinue the technica...

(RHSA-2009:0297) Low: Red Hat Enterprise Linux 2.1 - 3 Month End Of Life Notice

In accordance with the Red Hat Enterprise Linux Errata Support Policy, the 7 years life-cycle of Red Hat Enterprise Linux 2.1 will end on May 31 2009. After that date, Red Hat will discontinue the technical support services, bugfix, enhancement and security errata updates for the following...

Java Runtime Environment JAR manifest Main Class buffer overflow

Added: 02/26/2009 CVE: CVE-2008-5354 BID: 32608 OSVDB: 50499 Background Java Runtime Environment JRE allows end users to run Java applications. Problem A buffer overflow vulnerability in JRE allows command execution when a user opens a JAR archive containing a manifest file with a specially craft...

Java Runtime Environment JAR manifest Main Class buffer overflow

Added: 02/26/2009 CVE: CVE-2008-5354 BID: 32608 OSVDB: 50499 Background Java Runtime Environment JRE allows end users to run Java applications. Problem A buffer overflow vulnerability in JRE allows command execution when a user opens a JAR archive containing a manifest file with a specially craft...

Adobe under fire for poor security response

In the wake of the zero-day attacks against Adobe’s Acrobat and Reader product lines, the company is taking a lot of flack for its poor response to handling the issue — specifically around communicating the risks and providing migitation guidance for end users. Over on the ZDNet Zero Day blog, I...

Code injection

Tor 0.2.0.28, and probably 0.2.0.34 and earlier, allows remote attackers, with control of an entry router and an exit router, to confirm that a sender and receiver are communicating via vectors involving 1 replaying, 2 modifying, 3 inserting, or 4 deleting a single cell, and then observing cell...

SuSE Update for clamav SUSE-SA:2007:033

Check for the Version of clamav OpenVAS Vulnerability Test $Id: gbsuse2007033.nasl 8050 2017-12-08 09:34:29Z santu $ SuSE Update for clamav SUSE-SA:2007:033 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software;...

No routing password permissions when the Dove on-line method-vulnerability warning-the black bar safety net

No routing password permissions when the pigeons on the line method: The first step:tools--FTP--FTP home directory, just in the desktop build one, put the following ports into 2 1. The user name can not fill. The following two options are marked with a tick. Then turn on the service. Completed th...

MYBBS系统存在漏洞

1.用户注册功能页面没有针对无用户名注册的过滤用户注册功能页面没有针对用户名的长度的过滤用户注册功能页面没有针对无密码用户的过滤用户注册功能页面没有针对用户签名以及个人介绍的字数限制用户注册功能页面没有针对用户头像大小以及规格的限制 2.论坛版面最新回复所调用字数的限制论坛版面发表新文章的主题字数限制论坛版面发表新文章内容部分的字数限制论坛版面发表新文章针对JS的过滤 3.论坛短信功能页面没有针对发表人以及回复人的限制论坛短信功能页面对于JS恶意代码的过滤（JS代码嵌入漏洞论坛短信功能页面没有针对发表后页面的时间限制（可以导致无限制短信DOS...