FTC Asking DEF CON to Help Catch Robocallers

The United States Federal Trade Commission is sick and tired of illegal robocalling, and it’s hosting a contest this year at the DEF CON hacker conference in Las Vegas in an attempt to do something about it. The consumer protection agency’s weariness likely stems from the more than 150,000...

IBM DB2 Stored Procedure Infrastructure Privilege Escalation Vulnerability

According to its version, the installation of IBM DB2 running on the remote host is affected by a privilege escalation vulnerability. An error exists related to the Stored Procedure infrastructure and the 'CREATEEXTERNALROUTINE' authority that allows an authenticated user to escalate privileges...

[musl] Security advisory for musl libc - remote stack-based buffer overflow in DNS response parsing [CVE-2014-3484]

A remote stack-based buffer overflow has been found in musl libc's dns response parsing code. The overflow can be triggered in programs linked against musl libc and making dns queries via one of the standard interfaces getaddrinfo, getnameinfo, gethostbyname, gethostbyaddr, etc. if one of the...

DDoS Attacks Take Down Evernote, Feedly

UPDATED — News aggregator Feedly is still offline Thursday as continues to battle a series of distributed denial of service attacks that’s kept the service down for two consecutive days. The site was able to get back online shortly after 3 p.m. Wednesday after it neutralized the first DDoS attack...

Android Ransomware First to Encrypt Data on Mobile Devices

A strain of ransomware that encrypts data on Android mobile devices, the first of its kind, has spread to 13 countries since it was first spotted less than a month ago. Researchers at Kaspersky Lab today disclosed details on Pletor, an expensive Trojan that popped up on an underground forum selli...

Debian Security Advisory DSA 2953-1 (dpkg - security update)

Multiple vulnerabilities were discovered in dpkg that allow file modification through path traversal when unpacking source packages with specially crafted patch files. This update had been scheduled before the end of security support for the oldstable distribution squeeze, hence an exception has...

OpenSSL issued a warning: memory 1 0 years of vulnerability may be hackers for“man in the middle”attack-vulnerability warning-the black bar safety net

On Thursday, the OpenSSL Foundation issued a warning that one already exists 1 0 years of the vulnerabilities could lead to hackers through the use of OpenSSL to encrypt the traffic to launch“man in the middle”attack. Information security experts are still trying to solve the OpenSSL encryption...

OpenSSL Receives Funding for Developers, Will Undergo Security Audit

Scarcely a month after announcing the formation of a group designed to help fund open source projects, the Core Infrastructure Initiative has decided to provide the OpenSSL Project with enough money to hire two full-time developers and also will fund an audit of OpenSSL by the Open Crypto Audit...

[SECURITY] Fedora 19 Update: zabbix-2.0.12-1.fc19

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechan ism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

[SECURITY] Fedora 20 Update: zabbix-2.0.12-1.fc20

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechan ism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

Executive Agencies Pass on New Cybersecurity Regulations

Three Executive Branch federal agencies crucial to critical infrastructure protection will be allowed to continue to voluntarily assess cyber risk, rather than force the development and implementation of additional regulations. The White House yesterday released its conclusions as they relate to...

Critical Infrastructure Continues to Patch Heartbleed

Unified Automation issued a security advisory warning that its OPC UA software developers kit SDK for Windows contains the OpenSSL cryptography library that is vulnerable to Heartbleed. Schneider Electric, another industrial control system ICS manufacturer, posted its own advisory with mitigation...

Points of Sale Poorly Secured, Facing Sophisticated Attacks

The point-of-sale PoS systems on which financial transactions are conducted at nearly every physical retail location in the U.S. and and beyond are fast becoming a favorite target for sophisticated criminal organizations as well as standalone attackers. The emergence of this trend is unsurprising...

Fedora Update for python-fedora FEDORA-2014-5962

Check for the Version of python-fedora OpenVAS Vulnerability Test Fedora Update for python-fedora FEDORA-2014-5962 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it...

Skybox Security 6.3.x - 6.4.x - Multiple Information Disclosure

Exploit for hardware platform in category web applications Exploit Title: SKYBOX Security – Multiple Information Disclosure Date: 22-Jan-2014 Exploit Author: Luigi Vezzoso Vendor Homepage: http://www.skyboxsecurity.com Version: Skybox View Appliances with ISO versions: 6.3.33-2.14, 6.3.31-2.14,...

Fedora Update for zabbix FEDORA-2014-5551

Check for the Version of zabbix OpenVAS Vulnerability Test Fedora Update for zabbix FEDORA-2014-5551 Authors: System Generated Check Copyright: Copyright C 2014 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the term...

[SECURITY] Fedora 20 Update: zabbix-2.0.11-3.fc20

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechan ism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

[SECURITY] Fedora 19 Update: zabbix-2.0.11-3.fc19

Zabbix is software that monitors numerous parameters of a network and the health and integrity of servers. Zabbix uses a flexible notification mechan ism that allows users to configure e-mail based alerts for virtually any event. This allows a fast reaction to server problems. Zabbix offers...

Debian Security Advisory DSA 2915-1 (dpkg - security update)

Jakub Wilk discovered that dpkg did not correctly parse C-style filename quoting, allowing for paths to be traversed when unpacking a source package - leading to the creation of files outside the directory of the source being unpacked. The update to the stable distribution wheezy incorporates...

Group Backed by Google, Microsoft and Others to Help Fund OpenSSL and Other Open Source Projects

After the dust had started to settle in the wake of the OpenSSL Heartbleed vulnerability earlier this month, one of the common sentiments that emerged was that the small group developing and maintaining the software needed some help. And money. And resources. But mostly money. Now, the OpenSSL...