Common Security Mistakes Can Lead to Major Compromises

SAN FRANCISCO–Security is hard and getting it right all the time is nearly impossible. But many of the mistakes that people make are simple, avoidable ones that can lead to serious intrusions and major network compromises. “Maintaining network defenses by hand is difficult,” Mike Lloyd, chief...

Fedora 13 : tor-0.2.1.28-1300.fc13 (2010-19159)

Major bugfixes : - Fix a remotely exploitable bug that could be used to crash instances of Tor remotely by overflowing on the heap. Remote-code execution hasn't been confirmed, but can't be ruled out. Everyone should upgrade. CVE-2010-1676 Directory authority changes : - Change IP address and por...

Private Web Browsing Is Mostly A Failure

Features in the four major browsers designed to cloak users’ browser history often don’t work as billed, according to a research paper that warns that users may get a false sense of security when using the built-in privacy settings. Read the full article. The Register...

It's Official: DNSSEC Fully Updated

Two years after a major flaw was exposed in the Internet’s Domain Name System DNS, a major upgrade to the infrastructure protocol that fixes that weakness is now up and running in all of the Internet root servers. Read the full article. Dark Reading...

sNews - 'index.php' SQL Injection

Exploit Title:sNews index.php SQL Injection Vulnerability Date: 2010-07-24 Author: MajoR Software Link: http://snews.awddesign.co.uk Version: N/A Tested on: Wnidows xp SP2 CVE : N/A ====================================================sNews index.php SQL Injection Vulnerability...

Vulnerabilities with Windows file default stream

Vulnerabilities with Windows file default stream Severity: major CVE-2010-2263 Not vulnerable: 0.8.40+, 0.7.66+ Vulnerable: nginx/Windows 0.7.52-0.8.39...

TJX Hacker Gets 20-Year Jail Sentence

Hacker mastermind Albert Gonzalez was sentenced Thursday in U.S. District Court to two concurrent 20-year stints in prison for his role in what prosecutors called the “unparalleled” theft of millions of credit card numbers from major U.S. retailers. U.S. District Court Judge Patti B. Saris...

Null pointer dereference vulnerability

Null pointer dereference vulnerability Severity: major CVE-2009-3896 Not vulnerable: 0.8.14+, 0.7.62+, 0.6.39+, 0.5.38+ Vulnerable: 0.1.0-0.8.13...

The renegotiation vulnerability in SSL protocol

The renegotiation vulnerability in SSL protocol Severity: major CVE-2009-3555 Not vulnerable: 0.8.23+, 0.7.64+ Vulnerable: 0.1.0-0.8.22...

Buffer underflow vulnerability

Buffer underflow vulnerability Severity: major CVE-2009-2629 Not vulnerable: 0.8.15+, 0.7.62+, 0.6.39+, 0.5.38+ Vulnerable: 0.1.0-0.8.14...

AST-2009-006: IAX2 Call Number Resource Exhaustion

Asterisk Project Security Advisory - AST-2009-006 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | IAX2 Call Number Resource Exhaustion |...

Ordinary users by udev vulnerability to elevate to root permissions demo-vulnerability warning-the black bar safety net

Recently exposed by the udev permissions hint of vulnerability, as long as with normal user permissions, you can elevate to root privileges, the experiment a handful, really easy to upgrade. Put the following code saved as test. sh file !/ bin/sh Linux 2.6 bug found by Sebastian Krahmer lame splo...

Puerto Rico sites redirected in DNS attack

From CNet News Elinor Mills An attack on the main domain name system registrar in Puerto Rico led to the local Web sites of Google, Microsoft, Yahoo, Coca-Cola, and other big companies being redirected for a few hours on Sunday to sites that were defaced, according to security firm Imperva. Those...

CMS-School 2005 - showarticle.php SQL Injection

CMS-School 2005 - showarticle.php SQL Injection ! ! ! OOOO O OOOOOOOOO ! !O O O O O ! !O O O ! !O OOOO OOOO OOOOOO OOOO OOO OO O OOOO OO OO OOOO ! !O OOO OOO O O O O OO O O O O OO O O O ! !O OO OO O O OOOOOO O O O O O O OOOOOO ! !O O OOOO O O O O O O O O O O O ! ! OOOO OO OOOOOO OOOO OOOOOO...

nss_ldap security and bug fix update

253-5 - build with strict-aliasing disabled, because pamldap breaks strict-aliasing rules without it tools 253-4 - block SIGPIPE in the atfork handler, so that it doesnt trip up when attempting to drop a connection to the server 448833 253-3 - add patch to make netgroup enumeration fail due to la...

rPSA-2008-0211-1 mercurial mercurial-hgk

rPath Security Advisory: 2008-0211-1 Published: 2008-07-03 Products: rPath Linux 2 Rating: Major Exposure Level Classification: Indirect User Deterministic Unauthorized Access Updated Versions: mercurial=conary.rpath.com@rpl:2/1.0.1-1-0.1 mercurial-hgk=conary.rpath.com@rpl:2/1.0.1-1-0.1 rPath Iss...

AST-2008-009: (Corrected subject) Remote crash vulnerability in ooh323 channel driver

Asterisk Project Security Advisory - AST-2008-009 +------------------------------------------------------------------------+ | Product | Asterisk-Addons | |--------------------+---------------------------------------------------| | Summary | Remote crash vulnerability in ooh323 channel | | | driv...

AST-2008-003: Unauthenticated calls allowed from SIP channel driver

Asterisk Project Security Advisory - AST-2008-003 +------------------------------------------------------------------------+ | Product | Asterisk | |--------------------+---------------------------------------------------| | Summary | Unauthenticated calls allowed from SIP channel | | | driver |...

rPSA-2008-0084-1 lighttpd

rPath Security Advisory: 2008-0084-1 Published: 2008-02-28 Products: rPath Linux 1 Rating: Major Exposure Level Classification: Remote Deterministic Denial of Service Updated Versions: lighttpd=conary.rpath.com@rpl:1/1.4.18-0.2-1 rPath Issue Tracking System: https://issues.rpath.com/browse/RPL-22...

xigla-sql.txt

HackerSafe Labs - Security Advisory http://www.hackersafelabs.com/ Date: 12/06/2007 Vendor: http://www.xigla.com Package: Xigla Absolute Banner Manager Versions: v4.0 Credit: Joseph Pierini - HackerSafe Labs Risk: Related Exploit Range: Remote Attack Complexity: Medium Level of Authentication...