kernel: heap/stack gap jumping via unbounded stack allocations

A flaw was found in the way memory was being allocated on the stack for user space binaries. If heap or different memory region and stack memory regions were adjacent to each other, an attacker could use this flaw to jump over the stack guard gap, cause controlled memory corruption on process sta...

kernel security update

2.6.32-696.3.2.OL6 - Update genkey bug 25599697 2.6.32-696.3.2 - mm enlarge stack guard gap Larry Woodman 1452729 1452730 CVE-2017-1000364 CVE-2017-1000366...

kernel security update

3.10.0-514.21.2.OL7 - Oracle Linux certificates Alexey Petrenko - Oracle Linux RHCK Module Signing Key was compiled into kernel [email protected] - Update x509.genkey bug 24817676 3.10.0-514.21.2 - mm enlarge stack guard gap Larry Woodman 1452732 1452733...

This Week in Security News

Welcome to our weekly roundup, where we share what you need to know about the cybersecurity news and events that happened over the past few days. Below you’ll find a quick recap of topics followed by links to news articles and/or our blog posts providing additional insight. Be sure to check back...

Today’s File Security is So ’80s, Part 1: Why the Traditional Approach to File Security is Broken

In today’s knowledge-driven economy, modern enterprises have a fluid organizational structure in which most employees have access to most data to do their jobs. Working groups are formed organically and are cross-functional by nature. The amount of unstructured data organizations create is growin...

Bridging the Skills Gap with Trend Micro’s Capture the Flag (CTF) Competition

We all know the IT security industry is suffering from chronic skills gaps and shortages around the world. In the US things are no different, with an estimated talent shortfall of around 40,000 jobs for information security analyst roles alone. While various initiatives have been proposed, few ha...

The vulnerability of Microsoft Exchange Server servers allows a hacker to inject arbitrary Web or HTML code.

The vulnerability of Microsoft Exchange Server exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary Web or HTML code via email or chat clients...

DHS Chairman Paints Bleak U.S. Cybersecurity Picture

SAN FRANCISCO – The United States is losing ground against its adversaries as illustrated by reports of Russian and Chinese hacking of U.S. interests, and breaches against private companies such as Yahoo, said Rep. Michael McCaul R-TX, chairman of the House Committee on Homeland Security, during ...

USB Key Cleaner: CIRCLean

USB Key Cleaner Malware regularly uses USB sticks to infect victims, and the abuse of USB sticks is a common vector of infection. CIRCLean is an independent hardware solution to clean documents from untrusted obtained USB keys / USB sticks. The device automatically converts untrusted documents in...

The vulnerability of the Android operating system, which allows a perpetrator to trigger a service failure or otherwise affect the system.

The vulnerability of the Audioserver component of the libeffects sub-component in the Android operating system is related to the lack of protection for service data. Exploiting this vulnerability can allow a malicious actor to cause service failures or otherwise affect the system...

Multiple vulnerabilities in the Kaspersky Total Security antivirus protection system allow attackers to obtain confidential information.

The multiple vulnerabilities of the KLDISK driver in the Kaspersky Total Security antivirus protection software are related to the lack of protection for operational data. Exploiting these vulnerabilities could allow an intruder, operating locally, to gain access to confidential information—such ...

Time Gap Hidden Object Mystery - Base64 encoded String, Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Time Gap Hidden Object Mystery published at the 'play' market has multiple vulnerabilities...

Hackers and Developers Need to Hug it Out

The divide between developers and hackers is real. So, apparently, is the effort to bring them together and make them play nicely. “It’s not just a knowledge gap, but an empathy gap,” said I Am The Cavalry founder Josh Corman during a panel discussion at last week’s RSA Conference. “One common...

The vulnerability of the Tivoli Storage Manager FastBack data management program allows a hacker to execute arbitrary code.

The vulnerability of the Tivoli Storage Manager FastBack data management program is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

AirHopper — Hacking Into an Isolated Computer Using FM Radio Signals

In order to secure sensitive information such as Finance, many companies and government agencies generally use totally secure computer systems by making sure it aren't connected to any network at all. But the most secure systems aren't safe anymore. Security researchers at the Cyber Security Labs...

Whale Communications e-Gap Security Appliance 2.5 Login Page Source Code Disclosure Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9431/info The e-GAP appliance has been reported prone to a source code disclosure vulnerability. It has been reported that, when the affected appliance handles unexpected HTTP requests it may divulge the source code of th...

Trend Micro InterScan VirusWall for Windows NT 3.52 Space Gap Scan Bypass

No description provided by source. source: http://www.securityfocus.com/bid/5259/info A vulnerability has been reported in certain VirusWall versions. Reportedly, it is possible to bypass the scanning mechanism of VirusWall by adding extraneous spaces in certain email HTTP header fields. A...

openSUSE Security Update : gnutls (openSUSE-SU-2010:1025-1)

The SSL-renegotiation 'authentication gap' has been fixed in gnutls. CVE-2009-3555 has been assigned to this issue. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update gnutls-3388. The text...

Target Kill Chain Analysis

Last week, I talked with Wall Street Journal reporter Ben DiPietro about the persistent communications gap between the data center and the board room when it comes to recognizing and tackling security threats: In almost every breach situation after his company completes a forensic analysis, Mr...

08cms GETSHELL vulnerabilities-vulnerability warning-the black bar safety net

08cms GETSHELL Directly on the Exp ? php / Car CMS4. 1 GBK version: exp index. php? tplname=..%252f..%252fdynamic%252fstats%252faclicks. cac shell /dynamic/tplcache/common/....dynamicstatsaclicks.cac.php Decoration of the CMS: shell: /dynamic/dynamic/stats/aclicks.cac.php / $exp = '/tools/ptool...