NSA to Run $1.5B Security Data Center

The National Security Agency is going to run a planned $1.5 billion data center in Utah that will serve as a support center for the government’s information security programs. The exact mission and function of the data center is a bit unclear, however. The NSA’s core mission is to collect and...

Obama Nominates DHS Intelligence Chief

President Barack Obama has nominated Caryn Wagner to be the Homeland Security Department s intelligence chief, a position that oversees information technology systems designed to share information with federal, state and local officials. If confirmed by the Senate, Wagner would direct DHS Office ...

Design/Logic Flaw

Unspecified vulnerability in the Business Intelligence Enterprise Edition component in Oracle Application Server 10.1.3.4.1 allows local users to affect confidentiality via unknown vectors...

Code injection

Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors...

CVE-2009-1999

Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors...

CVE-2009-1990

CVE-2009-1990 affects Oracle Application Server BI Enterprise Edition (Business Intelligence Enterprise Edition component) in Oracle Application Server 10.1.3.4.1. The Oracle CPU/Oracle Application Server risk matrix lists this as a local vulnerability with confidentiality impact Partial and no e...

CVE-2009-1999

Oracle Application Server: CVE-2009-1999 affects the Business Intelligence Enterprise Edition component. The Oracle Application Server risk matrix lists a network-exploitable vulnerability with CVSS v2 base score 4.3 (Partial integrity impact). The vulnerability is described as an unspecified iss...

CVE-2009-1999

Unspecified vulnerability in the Business Intelligence Enterprise Edition component in unspecified Oracle Application Server versions allows remote attackers to affect integrity via unknown vectors...

Oracle BI help page - XSS

Application: Oracle Business Intelligence Versions Affected: Oracle Business Intelligence Enterprise Edition 10.1.3.4.0 Vendor URL: http://www.oracle.com Bugs: XSS/phishing credentials Exploits: YES Reported: 26.06.2009 Vendor response: 27.06.2009 Last response: 30.06.2009 Patched: 16.10.2012 Dat...

Forensic experts fuse technology, intelligence for investigations

From The New York Times John Markoff The small cadre of experts who spend their time doing the meticulous, painstaking work of tracing cyber attacks is increasingly relying on a combination of advanced technical tools and old-fashioned intelligence-gathering techniques to track down the people an...

Defense Industrial Base information-sharing program a good start

The recent flood of stories on attacks against the electrical grid, various government agencies and other portions of the critical infrastructure has renewed the calls for improvements in federal cybersecurity and, especially, information sharing between the government and the private sector on...

Clarity needed on cyberwar plans, study says

From The New York Times John Markoff and John Shanker A study conducted by the National Academy of Sciences found that the United States military needs to create an open, public dalogue to clarify its plans around using offensive weapons in cyberspace. The study also recommends that the military...

Opentaps ERP + CRM Detection

The remote host is running Opentaps ERP + CRM. Opentaps is a full-featured ERP + CRM suite which incorporates several open source projects, including: - Apache Geronimo, Tomcat, and OFBiz for the data model and transaction framework - Pentaho and JasperReports for business intelligence - Funambol...

Mini-Metricon Highlighted Risk, Measurements

I spent some time earlier this week at mini-metricon, a workshop that was inspired by the success of Andrew Jaquith’s security metrics mailing list and the larger Metricon which is held each year in conjunction with the USENIX Security Conference. In essence members of the mailing list gather eac...

Malicious web sites jump 200 percent

By Vivian Yeo, ZDNet Asia The threat from Web-based malware is growing at a rapid pace, with nearly 200 percent more malicious sites zdnet.com identified this month, according to a new report from MessageLabs. Released Tuesday, the MessageLabs Intelligence Report revealed that 2, 797 new Web site...

Secunia Research: ksquirrel-libs Radiance RGBE Buffer Overflows

====================================================================== Secunia Research 25/02/2009 - ksquirrel-libs Radiance RGBE Buffer Overflows - ====================================================================== Table of Contents Affected...

Security Best Practice: Get Yourself Familiar with the Header Rejection Tool

Web servers and applications parse not only the URL, but also the rest of the HTTP header data. Wrong parsing can lead to buffer overrun attacks and other vulnerabilities. Some exploits use the HTTP headers to cause damage. The exploit can be carried in standard headers the Host header for exampl...

rdesktop 1.5.0 - process_redirect_pdu() BSS Overflow (PoC)

rdesktop 1.5.0 - processredirectpdu BSS Overflow PoC !/usr/bin/perl http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=697 use strict; use IO::Socket; my $sock = IO::Socket::INET-newLocalAddr = '0.0.0.0', LocalPort = '3389', Listen = 1, Reuse = 1 || die$!; my $evil =...

securityreporter-traverse.txt

SECURITYREPORTER - AUTHENTICATION BYPASS AND DIRECTORY TRAVERSAL VULNERABILITY Product: SecurityReporter Version: 4.6.3 Build Date: 04/20/2007 Platform: Win32 Vendor: Secure Computing www.securecomputing.com Product Description ------------------- "SecurityReporter is a security event analysis an...

[Full-disclosure] Secure Computing - Security Reporter Auth Bypass and Directory Traversal Vulnerability

SECURITYREPORTER - AUTHENTICATION BYPASS AND DIRECTORY TRAVERSAL VULNERABILITY Product: SecurityReporter Version: 4.6.3 Build Date: 04/20/2007 Platform: Win32 Vendor: Secure Computing www.securecomputing.com Product Description ------------------- "SecurityReporter is a security event analysis an...