SuSE 10 Security Update : Mozilla NSS (ZYPP Patch Number 6541)

The Mozilla NSS security framework was updated to version 3.12.3.1. - Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger AIM, allows remote SSL...

openSUSE 10 Security Update : libfreebl3 (libfreebl3-6494)

The Mozilla NSS and dependend libraries were updated to fix various issues. CVE-2009-2404 / MFSA 2009-43 : Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Insta...

SuSE 11 Security Update : Mozilla Firefox (SAT Patch Number 1199)

The Mozilla NSS security framework was updated to version 3.12.3.1. - Heap-based buffer overflow in a regular-expression parser in Mozilla Network Security Services NSS before 3.12.3, as used in Firefox, Thunderbird, SeaMonkey, Evolution, Pidgin, and AOL Instant Messenger AIM, allows remote SSL...

RHEL 3 : seamonkey (RHSA-2009:1432)

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client,...

Stable Update: Security fixes

Google Chrome 2.0.172.43 has been released to the Stable channel to fix the security issues listed below. CVE-2009- 2935 Unauthorized memory read from Javascript A flaw in the V8 Javascript engine might allow specially-crafted Javascript on a web page to read unauthorized memory, bypassing securi...

Ubuntu: Security Advisory (USN-810-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RedHat Security Advisory RHSA-2009:1207

The remote host is missing updates to Netscape Portable Runtime NSPR and Network Security Services NSS announced in advisory RHSA-2009:1207. These updated packages upgrade NSS from the previous version, 3.12.2, to a prerelease of version 3.12.4. The version of NSPR has also been upgraded from 4.7...

DNS BailiWicked Host Attack

This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed Jul 2008. This exploit caches a single malicious host entry into the target nameserver by sending random hostname queries to the target DNS server coupled with spoofed replies to those...

Ubuntu 8.04 LTS / 8.10 / 9.04 : nss vulnerabilities (USN-810-1)

Moxie Marlinspike discovered that NSS did not properly handle regular expressions in certificate names. A remote attacker could create a specially crafted certificate to cause a denial of service via application crash or execute arbitrary code as the user invoking the program. CVE-2009-2404 Moxie...

Ubuntu 8.04 LTS / 8.10 / 9.04 : nspr update (USN-810-2)

USN-810-1 fixed vulnerabilities in NSS. This update provides the NSPR needed to use the new NSS. Moxie Marlinspike discovered that NSS did not properly handle regular expressions in certificate names. A remote attacker could create a specially crafted certificate to cause a denial of service via...

DNS BailiWicked Domain Attack

This exploit attacks a fairly ubiquitous flaw in DNS implementations which Dan Kaminsky found and disclosed Jul 2008. This exploit replaces the target domains nameserver entries in a vulnerable DNS cache server. This attack works by sending random hostname queries to the target DNS server coupled...

One Year Later: Dan Kaminsky on DNS Security Problems

From SearchSecurity Network security researcher Dan Kaminsky has had a year to reflect on the impact of the cache poisoning vulnerability he discovered in the Domain Name System DNS. Kaminsky revealed during last year’s Black Hat Briefings a technique that made it relatively easy to exploit the b...

DNS vulnerabilities to attack the Ruby code-vulnerability warning-the black bar safety net

1 require 'msf/core' 2 require 'net/dns' 3 require 'scruby' 4 require 'resolv' 5 6 module Msf 7 8 class Auxiliary::Spoof::Dns::BaliWickedHost Msf::Auxiliary 9 1 0 The include Exploit::Remote::Ip 1 1 1 2 def initializeinfo = 1 3 superupdateinfoinfo, 1 4 'Name' = 'DNS BaliWicked Attack', 1 5...

Infrastructure attacks: A growing concern

In an essay published on his personal blog doxpara.com, security researcher Dan Kaminsky is starting to sound the alarm about “the extraordinary damage” we face from infrastructure attacks, warning that the industry needs to treat infrastructure with more security due diligence and care. “Forget...

Ubuntu Update for dnsmasq vulnerability USN-627-1

Ubuntu Update for Linux kernel vulnerabilities USN-627-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN6271.nasl 7969 2017-12-01 09:23:16Z santu $ Ubuntu Update for dnsmasq vulnerability USN-627-1 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH,...

Joe Grand on hardware hacking

In this Network World interview at SOURCE Boston, well-known hardware hacker Joe ‘Kingpin’ Grand talks about lessons rom the “Prototype This” show, the changing face of security research and his upcoming vulnerability assessment work. The video also includes an interview with Dan Kaminsky about h...

CentOS Update for bind CESA-2008:0533-03 centos2 i386

Check for the Version of bind OpenVAS Vulnerability Test CentOS Update for bind CESA-2008:0533-03 centos2 i386 Authors: System Generated Check Copyright: Copyright c 2009 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it unde...

DSA-1659-1 libspf2 - potential remote code execution

Bulletin has no description...

LibSPF2 < 1.2.8 DNS TXT Record Parsing Bug Heap Overflow PoC

Exploit for multiple platform in category dos / poc ============================================================ LibSPF2 1.2.8 DNS TXT Record Parsing Bug Heap Overflow PoC ============================================================ Advisory: DNS TXT Record Parsing Bug in LibSPF2 Author: Dan...

LibSPF2 < 1.2.8 - DNS TXT Record Parsing Bug Heap Overflow (PoC)

Advisory: DNS TXT Record Parsing Bug in LibSPF2 Author: Dan Kaminsky, Director of Penetration Testing, IOActive Inc, [email protected] PGP Key In Appendix Abstract: A relatively common bug parsing TXT records delivered over DNS, dating at least back to 2002 in Sendmail 8.2.0 and almost...