Attackers Now Using Honeypots to Trap Researchers

Attackers are constantly changing their tactics and adapting to what the security community and researchers are doing, and it’s not unusual for the bad guys to adopt techniques used by their adversaries. The latest example of this is a malware gang that has deployed what amounts to a honeypot...

FTPPad 1.2.0 Stack Buffer Overflow

$Id: ftppadlistreply.rb 10661 2010-10-12 18:40:13Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...

Squid 3.1.6 DNS Reply Denial of Service

According to its banner, the version of the Squid proxy caching server installed on the remote host is 3.1.6. This version is affected by a denial of service vulnerability that is caused by an assertion failure when contacting IPv4-only DNS resolvers. Note that Nessus has relied only on the versi...

Portable Document Format - Specification Signature Collision

Portable Document Format - Specification Signature Collision source: https://www.securityfocus.com/bid/42377/info The Portable Document Format PDF specification is prone to a signature-collision attack when signing PDF documents. An attacker can exploit this issue to create PDF documents containi...

Private Web Browsing Is Mostly A Failure

Features in the four major browsers designed to cloak users’ browser history often don’t work as billed, according to a research paper that warns that users may get a false sense of security when using the built-in privacy settings. Read the full article. The Register...

The Rise of the Rogue AV Testers

By Costin Raiu Recently, I was sitting around with a number of colleagues from Kaspersky Lab, discussing everybody’s favorite subject: the state of anti-virus testing these days. During the talks, somebody brought up the name of a new, obscure testing organization in the Far East. Nobody else had...

CGI Generic Path Traversal (write test)

The remote web server hosts CGI scripts that fail to adequately sanitize request strings and are affected by directory traversal or local file inclusion vulnerabilities. By leveraging this issue, an attacker may be able to modify arbitrary files on the web server or execute commands. Due to the w...

McAfee DAT 5958 Issues

US-CERT is aware of public reports indicating that McAfee DAT release 5958 is incorrectly identifying the valid system file, C:\Windows\system32\svchost.exe, as containing malicious code. Reports indicate that a false positive detection occurs on Windows XP Service Pack 3 systems. Symptoms includ...

Google Releases Skipfish Application Security Scanner

Google has released its own Web application security scanner, called Skipfish. The free scanner is designed to work within a variety of existing Web application frameworks and is built with an emphasis on speed and low false-positives, the company said. Skipfish enters a crowded field of Web...

Zeus/Zbot Banking Trojan/Data Theft (credentialed check)

The remote Windows host has files that indicate that the Zeus also known as Zbot banking trojan has been installed, or that stolen data collected by this trojan remains on the system. The Zeus trojan will intercept and log activity related to online banking, as well as other logins, such as web,...

Facebook Warns of Profile Stalking Scam

A bogus application that lures Facebook users by falsely offering to show who has been viewing their profile has been exposed as a scam. A researcher warns he has already identified 25 different copies of the same rogue app but using different monikers such as peeppeep-pro, profile-check-online a...

Mozilla Apologizes for Blaming Malware on Developers

Mozilla acknowledged that it had falsely accused a developer of infecting a Firefox add-on with attack code. The admission came a week after Mozilla announced that a pair of add-ons, Sothink Web Video Downloader 4.0 and Master Filer, had slipped through its security check-in. Read the full articl...

On The Way to Better Malware Testing

Have you ever found a false positive when uploading a file to a website like VirusTotal? Sometimes it happens that not just one scanner detects the file, but several. This leads to an absurd situation where every product which doesn’t detect this file automatically looks bad to users who don’t...

Web fonts can be used to spoof the page address

In some cases, a Web font intended to be used for page content could be incorrectly used by Opera to render parts of the user interface, including the address field. This can be used by a malicious site to display a false domain name in the address field...

kernel security and bug fix update

2.6.9-89.0.15.0.1.EL - fix skb alignment that was causing sendto to fail with EFAULT Olaf Kirch orabug 6845794 - fix enomem due to larger mtu size page alloc Zach Brown orabug 5486128 - backout patch sysrq-b that queues upto keventd thread Guru Anbalagane orabug 6125546 - netrx/netpoll race...

Riorey RIOS Hardcoded Password Vulnerability 4.7.0

Exploit for unknown platform in category remote exploits ================================================== Riorey RIOS Hardcoded Password Vulnerability 4.7.0 ================================================== Title: Riorey RIOS Hardcoded Password Vulnerability 4.7.0 CVE-ID: OSVDB-ID: Author: Mar...

Riorey RIOS 4.7.0 - Hard-Coded Password

Severity: High Full root access to the device Date: 07 October 2009 Versions Affected: RIOS 4.6.6 , 4.7.0 possibly others Discovered on: 25 July 2009 Vendor URL: www.riorey.com Author: Marek Kroemeke Overview: Riorey DDoS mitigation appliences www.riorey.com are vulnerable to taking a full contro...

Riorey RIOS 4.7.0 - Hard-Coded Password

Riorey RIOS 4.7.0 - Hard-Coded Password Severity: High Full root access to the device Date: 07 October 2009 Versions Affected: RIOS 4.6.6 , 4.7.0 possibly others Discovered on: 25 July 2009 Vendor URL: www.riorey.com Author: Marek Kroemeke Overview: Riorey DDoS mitigation appliences www.riorey.co...

Google Chrome 2.0.172 - 'About:blank' Address Bar URI Spoofing 'About:blank' Address Bar URI Spoofing

source: https://www.securityfocus.com/bid/35839/info Google Chrome is affected by a URI-spoofing vulnerability. An attacker may leverage this issue by inserting arbitrary content to spoof a URI presented to an unsuspecting user. This may lead to a false sense of trust because the victim may be...

Backported Security Patch Detection (FTP)

Security patches may have been 'backported' to the remote FTP server without changing its version number. Banner-based checks have been disabled to avoid false positives. Note that this test is informational only and does not denote any security problem. C Tenable Network Security, Inc...