Podcast: 2014 Year in Review

Mike Mimoso and Dennis Fisher look back on the crazy year that was in security, including the big Internet-wide bugs such as Heartbleed and Shellshock, the Home Depot and Sony breaches and what lessons we learned in 2014.​ READ: 2014: A Specious Odyssey SEE: Revisiting Threatpost’s 10 Most Popula...

2014: A Specious Odyssey

The wonderful and terrifying thing about the security world is that things never stay calm for long. As soon as you think you have a chance to catch your breath, someone breaks something and it’s time to scramble again. In 2014, those small moments of downtime were hard to come by. There was a...

GLSA-201412-11 : AMD64 x86 emulation base libraries: Multiple vulnerabilities (Heartbleed)

The remote host is affected by the vulnerability described in GLSA-201412-11 AMD64 x86 emulation base libraries: Multiple vulnerabilities Multiple vulnerabilities have been discovered in AMD64 x86 emulation base libraries. Please review the CVE identifiers referenced below for details. Impact : A...

OracleVM 3.3 : openssl (OVMSA-2014-0032) (Heartbleed) (POODLE)

The remote OracleVM system is missing necessary patches to address critical security updates : - fix CVE-2014-3567 - memory leak when handling session tickets - fix CVE-2014-3513 - memory leak in srtp support - add support for fallback SCSV to partially mitigate CVE-2014-3566 padding attack on SS...

Microsoft Schannel Bug Latest in Long Line of Serious Crypto Flaws

The critical vulnerability in the Schannel technology in Windows that Microsoft patched Tuesday is ripe for exploitation, experts say, and continues the long line of severe vulnerabilities in major SSL/TLS implementations in recent months. Secure Channel, also known as Schannel, is a technology...

RHEL 6 : Storage Server (RHSA-2014:0377) (Heartbleed)

Updated openssl packages that fix one security issue are now available for Red Hat Storage 2.1. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

RHEL 6 : rhev-hypervisor6 (RHSA-2014:0396) (Heartbleed)

An updated rhev-hypervisor6 package that fixes one security issue is now available for Red Hat Enterprise Virtualization Hypervisor 3.2. The Red Hat Security Response Team has rated this update as having Important security impact. A Common Vulnerability Scoring System CVSS base score, which gives...

ACSC Left of Boom Panel Tackles Resilience to Next Heartbleed

BOSTON – Heartbleed, and the rash of Internet-wide bugs that will ultimately define security in 2014, tested the resilience of enterprises worldwide. In turn, resilience has been elevated as a major talking point for companies evaluating their preparedness for the inevitable next Heartbleed-type...

Mail.ru: OpenSSL HeartBleed (CVE-2014-0160)

Уязвимость существует на portal.sf.mail.ru Эта уязвимость позволяет читать оперативную память кусками размером до 64КБ. Причем уязвимость двусторонняя, это значит, что не только вы можете читать данные с уязвимого сервера, но и сервер злоумышленника может получить часть вашей оперативной памяти к...

Threat Outbreak Alert RuleID12041: Email Messages Distributing Malicious Software on October 20, 2014

Medium Alert ID: 36149 First Published: 2014 October 20 18:41 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID12041 may contain the following files: Name |...

Encryption security vulnerability“poodle”letting the hackers have the opportunity-vulnerability warning-the black bar safety net

Google three researchers found a new Internet vulnerability-the“poodle,”the vulnerability could access through the network found that the encryption of the data, allowing hackers access to the user's Bank accounts, email and other services. ! Following the“heartbleed”and“Shellshock”vulnerabilitie...

POODLE vulnerability assessment

Vulnerability Summary: The POODLE vulnerability is due to a bug in SSL protocol, whereas Heartbleed and Shellshock were vulnerability due to a bug in software. Heartbleed and Shellshock were confined to systems that ran vulnerable versions of software, whereas POODLE affects any system running an...

POODLE SSL 3.0 Attack Exploits Widely-used Web Encryption Standard

Another Heartbleed-like vulnerability has been discovered in the decade old but still widely used Secure Sockets Layer SSL 3.0 cryptographic protocol that could allow an attacker to decrypt contents of encrypted connections to websites. Google's Security Team revealed on Tuesday that the most...

Google engineers NeelMehta is how to find heart blood vulnerability-vulnerability warning-the black bar safety net

Heartbleed computer security vulnerabilityis by Google engineers NeelMehta found, has always been unwilling to accept media to interview him today for the first time to the media to say how he found this serious vulnerability; and why would go the first time to find the vulnerabilities, and he...

F5 Networks BIG-IP : OpenSSL vulnerability (K15159) (Heartbleed)

The 1 TLS and 2 DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, as demonstrated by reading private keys,...

OpenVPN vulnerable to Shellshock Bash vulnerability

OpenVPN wasn’t immune to the Heartbleed vulnerability in OpenSSL, and it’s not going to sidestep Shellshock either. Fredrick Stromberg, cofounder of Mullvad, a Swedish VPN company, reported that OpenVPN servers are vulnerable to Shellshock , the vulnerability in Bash plaguing Linux, UNIX and Mac ...

Linux Bash find significant security vulnerabilities to modify the method-vulnerability warning-the black bar safety net

GMT 9 August 2 5, message, Linux users today and got a“surprise”it! The Red Hat security team on Linux in the widely used Bash shell, found a subtle but dangerous security vulnerabilities. The vulnerability called the“Bash Bug”or“Shellshock”is. When the user normal access, the vulnerability allow...

Broken shell vulnerability, ShellShock emergency overview-vulnerability warning-the black bar safety net

| Key stage | public ---|--- Broken shell vulnerability, ShellShock emergency overview Third edition 2014/9/27 PM Know Chong Yu security research team 1. Updates Version | time | description ---|---|--- First edition | 2014/6/26 noon | first version completed. Second Edition | 2014/6/26 PM | 1...

Apple — Most Mac OS X Users Not Vulnerable to 'Shellshock' Bash Bug

On one hand where more than half of the Internet is considering the Bash vulnerability to be severe, Apple says the vast majority of Mac computer users are not at risk from the recently discovered vulnerability in the Bash command-line interpreter – aka the "Shellshock" bug that could allow hacke...

Major Bash Shell Vulnerability Affects Linux, UNIX, Mac OS X

A critical vulnerability in the Bourne again shell, simply known as Bash and which is present in most Linux and UNIX distributions and Apple’s Mac OS X, has been discovered and administrators are being urged to patch immediately. The flaw allows an attacker to remotely attach a malicious executab...