TANDBERG Remote Denial Of Service

Security Advisory Platform : TANDBERG Date : November 6, 2009 Affected : All MXP FIPS140 Current as of December 8, 2009 Tested : F8.2, F8.0, F7.2, F6.3 Unconf : VCS, BC, C90 Author : otokoyama Problem Description: Issues with the H.225 RAS implementation in TANDBERG Codecs. This has been confirme...

TANDBERG vF8.2 F8.0 F7.2 and F6.3 Remote Denial of Service

No description provided by source. Security Advisory Platform : TANDBERG Date : November 6, 2009 Affected : All MXP FIPS140 Current as of December 8, 2009 Tested : F8.2, F8.0, F7.2, F6.3 Unconf : VCS, BC, C90 Author : otokoyama Problem Description: Issues with the H.225 RAS implementation in...

Losing the Echo Chamber in the Critical Infrastructure Security Debate

As an analyst, and now as a consultant, I raise issues of digital and physical security: let’s talk about them, in plain terms, and collectively move to do something. As a member of the security digerati, I think we should be helping people, and we have to either step up with a better way forward...

[SECURITY] Fedora 10 Update: proftpd-1.3.2b-1.fc10

ProFTPD is an enhanced FTP server with a focus toward simplicity, security, and ease of configuration. It features a very Apache-like configuration syntax, and a highly customizable server infrastructure, including support for multiple 'virtual' FTP servers, anonymous FTP, and permission-based...

Authentication flaw

The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure VDI 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server...

CVE-2009-3923

The VirtualBox 2.0.8 and 2.0.10 web service in Sun Virtual Desktop Infrastructure VDI 3.0 does not require authentication, which allows remote attackers to obtain unspecified access via vectors involving requests to an Apache HTTP Server...

How to Take Down a Botnet

The botnet problem has reached epidemic levels in recent months, with the continued growth of large-scale botnets, as well as the identification of smaller, more targeted networks around the world. But researchers have been taking steps to disrupt botnets of late, with some notable successes, as...

CBS 60 Minutes on Cyber Terrorism

Could hackers get into the computer systems that run crucial elements of the world’s infrastructure, such as the power grids, water works or even a nation’s military arsenal? Watch the CBS News 60 Minutes segment. Read the transcript...

kernel security update

CentOS Errata and Security Advisory CESA-2009:1455 Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 23rd February 2010...

Amazon Moves to Mitigate Threats to Cloud Service

Amazon said today that it has taken steps to mitigate a security issue in its cloud computing infrastructure that was identified recently by researchers from MIT and the University of California at San Diego. The report described how attackers could search for, locate and attack specific targets ...

Clarke: Public Dialogue Needed on Cyberwar

Richard Clarke, a former top adviser on information security and terrorism in the Bush White House, is calling for Barack Obama to initiate an open public dialogue on the use of offensive and defensive information warfare capabilities and what the consequences of a cyberwar could be for the...

Report: Cyberterror Not a Credible Threat

A new report by a Washington policy think tank dismisses out of hand the idea that terrorist groups are currently launching cyber attacks and says that the recent attacks against U.S. and South Korean networks were not damaging enough to be considered serious incidents.The report, written by Jame...

Taking a Page From Singapore's Cybersecurity Playbook

We could all learn a thing or two about developing an effective cyber security strategy from the government of Singapore. I was recently in Singapore to do a keynote for Singapore GovWare on the Changing State of the Endpoint and, while I was out there, I witnessed something interesting the...

McKesson HCI Hardcoded Passwords

McKesson Horizon Clinical Infrastructure, also known as McKesson HCI, utilizes hardcoded passwords for Oracle database access. HCI serves as the patient record datastore for the majority of McKesson applications. There are two components to an HCI implementation: the Infrastructure or Master serv...

McKesson Horizon Clinical Infrastructure multiple hardcoded accounts

Multiple unchangable hardcoded accounts...

Moderate: Red Hat Security Advisory: kernel security and bug fix update

Updated kernel packages that fix one security issue and several bugs are now available for Red Hat Enterprise Linux 5. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Updated 23rd February 2010 This update adds references to two KBase articles...

CVE-2009-3441

Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to 1 graphs/alarmsevents.php or 2 host/drawtree.php...

Authentication flaw

Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to 1 graphs/alarmsevents.php or 2 host/drawtree.php...

CVE-2009-3441

Open Source Security Information Management OSSIM before 2.1.2 allows remote attackers to bypass authentication, and read graphs or infrastructure information, via a direct request to 1 graphs/alarmsevents.php or 2 host/drawtree.php...

CVE-2009-2856

Sun Virtual Desktop Infrastructure (VDI) 3.0 is affected when anonymous binding is enabled. The issue arises because the client’s attempt to establish an authenticated and encrypted connection is not properly handled, which might allow remote attackers to read cleartext VDI configuration‑data req...