Threat Outbreak Alert RuleID11654: Email Messages Distributing Malicious Software on September 22, 2014

Medium Alert ID: 35800 First Published: 2014 September 22 19:30 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID11654 may contain the following files: Name ...

Thousands of High-Risk Vulnerabilities Found in NOAA Satellite System

The informational systems that the National Oceanic and Atmospheric Administration NOAA run are loaded with several critical vulnerabilities that could leave it vulnerable to cyber attacks. According to the findings of an audit recently conducted by the Department of Commerce’s Office of the...

Research Finds No Large Scale Heartbleed Exploit Attempts Before Vulnerability Disclosure

In the days and weeks following the public disclosure of the OpenSSL Heartbleed vulnerability in April, security researchers and others wondered aloud whether there were some organizations–perhaps the NSA–that had known about the bug for some time and had been using it for targeted attacks. A...

OpenSSL Security Policy Made Public for First Time

OpenSSL has been having a rough go of it for some time thanks to Heartbleed and a handful of other critical vulnerabilities. Not only did those bugs put commerce and communication at risk, but they opened many people’s eyes as to how omnipresent the open source crypto implementation is. In an...

Kaspersky Internet Security Heartbeat Information Disclosure (Heartbleed)

The remote host has a version of Kaspersky Internet Security KIS installed that is missing a vendor patch. It is, therefore, affected by an information disclosure vulnerability. An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS heartbeat extensions that...

Community Health data leak suspected of the use of the Heartbleed vulnerability-a vulnerability warning-the black bar safety net

When the Heartbleed OpenSSL vulnerability in 4 months is discovered, the security community many experts are warning that the vulnerability could be used to expose sensitive data, although at the time also there is no evidence that attackers are actively using Heartbleed vulnerability. And now, a...

OpenSSL Heartbleed Impact, Vulnerabilities Down in 2014

On the one hand, the total number of vendor-reported vulnerabilities are down so far this year. On the other, 2014 was the year of the Heartbleed, the common name for a vulnerability in the nearly ubiquitous OpenSSL’s encryption implementation library, which IBM Security Systems characterized as...

Heartbleed Aftershocks: Community Health Systems Breach, 4.5 Million Records Lost

The news this week that hackers from China compromised 4.5 million customer records held by Community Health Systems is just the latest indication that companies are not adequately protecting the information of the consumers they serve...

Heartbleed Exploit Linked to Community Health Data Breach

Update: The Heartbleed OpenSSL vulnerability is now the centerpiece of the Community Health Systems data breach. Dave Kennedy, CEO of security consultancy TrustedSec, said yesterday that three sources close to the CHS investigation told him that a Heartbleed exploit was the hackers’ initial way i...

Siemens Patches DoS Vulnerability in SIMATIC S7

Siemens released an update for one of its automation systems late last week, patching a denial of service vulnerability in all versions of its SIMATIC S7-1500 CPU prior to V1.6. An advisory on the Industrial Control Systems Cyber Emergency Response Team’s ICS-CERT website warned about the...

Fedora 20 : openssl-1.0.1e-39.fc20 (2014-9308) (Heartbleed)

Multiple moderate issues fixed. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. %NASLMINLEVEL 70300 C...

HP LoadRunner 11.52.x < 11.52 Patch 2 / 12.00.x < 12.00 Patch 1 Heartbeat Information Disclosure (Heartbleed)

The version of HP LoadRunner installed on the remote host is 11.52.x prior to 11.52 Patch 2 or 12.00.x prior to 12.00 Patch 1. It is, therefore, affected by an out-of-bounds read error, known as the 'Heartbleed Bug' in the included OpenSSL version. This error is related to handling TLS heartbeat...

HP Version Control Repository Manager (VCRM) Heartbeat Information Disclosure (Heartbleed)

The HP Version Control Repository Manager VCRM install on the remote Windows host is version 7.2.0, 7.2.1, 7.2.2, 7.3.0, or 7.3.1. It is, therefore, affected by an information disclosure vulnerability. An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS...

HP Version Control Agent (VCA) Heartbeat Information Disclosure (Heartbleed)

The RPM installation of HP Version Control Agent VCA on the remote Linux host is version 7.2.2, 7.3.0, or 7.3.1. It is, therefore, affected by an information disclosure vulnerability. An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS heartbeat extensions...

HP Version Control Agent (VCA) Heartbeat Information Disclosure (Heartbleed)

The RPM installation of HP Version Control Agent VCA on the remote Linux host is version 7.2.2, 7.3.0, or 7.3.1. It is, therefore, affected by an information disclosure vulnerability. An out-of-bounds read error, known as the 'Heartbleed Bug', exists related to handling TLS heartbeat extensions...

[DLA 17-1] tor: new upstream version

Package : tor Version : 0.2.4.23-1deb6u1 The Tor version previously in Debian squeeze, 0.2.2.39, is no longer supported by upstream. This update brings the currently stable version of Tor, 0.2.4.23, to Debian squeeze. Changes include use of stronger cryptographic primitives, always clearing bignu...

Third-Party Software Library Risks Scrutinized at Black Hat

Enterprise application developers are under real pressures to push projects out the door quickly and cheaply, and each new version certainly has to be better than the last. This forces them to make decisions that, at a minimum, improve efficiency—and also introduce additional risks. Of particular...

How to prevent the next heartbleed-vulnerability warning-the black bar safety net

I. Introduction Based on the OpenSSL heart bleed vulnerability was considered to be the CVE-2 0 1 4-0 1 6 0 serious problem, OpenSSL is widely used in SSL and TLS plug-in. As used herein, the heart bleed vulnerability explanation this vulnerability is what is the use. This article studies the...

Oracle Critical Patch Update - July 2014

A Critical Patch Update CPU is a collection of patches for multiple security vulnerabilities. Critical Patch Update patches are generally cumulative, but each advisory describes only the security fixes added since the previous Critical Patch Update advisory. Thus, prior Critical Patch Update...

LibreOffice 4.2.x < 4.2.3 OpenSSL Multiple Vulnerabilities (Mac OS X) (Heartbleed)

A version of LibreOffice 4.2.x prior to 4.2.3 is installed on the remote Mac OS X host. This version of LibreOffice is bundled with a version of OpenSSL affected by multiple vulnerabilities : - An error exists in the function 'ssl3readbytes' that could allow data to be injected into other session...