JBoss 'mod_cluster'安全绕过漏洞

Bugtraq ID: 51554 CVE ID：CVE-2011-4608 JBOSS是一个基于J2EE的开放源代码的应用服务器。 modcluster允许worker节点在任意虚拟主机vhost上注册，而无视应用在其他虚拟主机上的安全性限制。在某些环境下，一个vhost配置为内部worker节点，而另一个配置为服务外部内容。远程攻击者可以利用此缺陷通过没有配置应用安全限制的外部虚拟主机注册为攻击者控制的worker节点，然后使用worker节点服务恶意内容，截获验证凭据，劫持用户会话。 0 Red Hat JBoss Enterprise Web Server for RHEL 6...

Important: Red Hat Security Advisory: mod_cluster-native security update

An updated modcluster-native package that fixes one security issue is now available for JBoss Enterprise Web Platform 5.1.2 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

mod_cluster: malicious worker nodes can register on any vhost

modcluster in JBoss Enterprise Application Platform 5.1.2 for Red Hat Linux allows worker nodes to register with arbitrary virtual hosts, which allows remote attackers to bypass intended access restrictions and provide malicious content, hijack sessions, and steal credentials by registering from ...

Important: Red Hat Security Advisory: mod_cluster-native security update

An update for the Native components for JBoss Enterprise Application Platform 5.1.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

Important: Red Hat Security Advisory: mod_cluster-native security update

An updated modcluster-native package that fixes one security issue is now available for JBoss Enterprise Application Platform 5.1.2 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scorin...

Important: Red Hat Security Advisory: mod_cluster-native security update

Updated modcluster packages that fix one security issue are now available for JBoss Enterprise Web Server 1.0.2 for Red Hat Enterprise Linux 4, 5, and 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base...

Important: Red Hat Security Advisory: mod_cluster-native security update

An update for the modcluster native component for JBoss Enterprise Web Server 1.0.2 that fixes one security issue is now available from the Red Hat Customer Portal. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System...

[SECURITY] Fedora 15 Update: python-celery-2.2.8-1.fc15

An open source asynchronous task queue/job queue based on distributed message passing. It is focused on real-time operation, but supports scheduling as well. The execution units, called tasks, are executed concurrently on one or more worker nodes using multiprocessing, Eventlet or gevent. Tasks c...

Fedora 16 : puppet-2.6.12-1.fc16 (2011-14880)

A bug in puppet's SSL certificate handling could allow nodes with a valid certificate to impersonate the puppet master. To be vulnerable, a user would have had to set the certdnsnames variable and generated certificates. This setting is not set by default in the Fedora/EPEL packages. This update...

bitcoin-getaddr NSE Script

Queries a Bitcoin server for a list of known Bitcoin nodes Script Arguments max-newtargets, newtargets See the documentation for the target library. Example Usage nmap -p 8333 --script bitcoin-getaddr Script Output PORT STATE SERVICE 8333/tcp open unknown | bitcoin-getaddr: | ip timestamp |...

Researchers To Demonstrate Tor Network Hijack Method

Researchers at the Hackers To Hackers Conference in Brazil will detail a method of hijacking the TOR anonymity network, potentially putting its users at risk, while The Tor Project accuses one of the researchers of irresponsible disclosure. The presentation combines work done by Eric Filiol of th...

Code injection

Google Chrome before 14.0.835.202 does not properly consider object lifetimes and thread safety during the handling of audio nodes, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

CVE-2011-2879

Google Chrome before 14.0.835.202 does not properly consider object lifetimes and thread safety during the handling of audio nodes, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

CVE-2011-2879

Google Chrome before 14.0.835.202 does not properly consider object lifetimes and thread safety during the handling of audio nodes, which allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors...

CVE-2011-2879

Removed by vendor...

CVE-2011-2879

CVE-2011-2879 affects Google Chrome older than 14.0.835.202. The root cause is improper handling of object lifetimes and thread safety during audio node processing, allowing remote attackers to cause a denial of service or potentially other unspecified impact via unknown vectors. Public reference...

Fedora Update for drupal6-views_bulk_operations FEDORA-2011-13180

Check for the Version of drupal6-viewsbulkoperations OpenVAS Vulnerability Test Fedora Update for drupal6-viewsbulkoperations FEDORA-2011-13180 Authors: System Generated Check Copyright: Copyright c 2011 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can...

[SECURITY] Fedora 15 Update: drupal6-views_bulk_operations-1.11-1.fc15

This module augments Views by allowing bulk operations to be executed on the nodes displayed by a view. It does so by showing a check box in front of each node, and adding a select box containing operations that can be applied on the selected nodes...

[SECURITY] Fedora 16 Update: drupal6-views_bulk_operations-1.11-1.fc16

This module augments Views by allowing bulk operations to be executed on the nodes displayed by a view. It does so by showing a check box in front of each node, and adding a select box containing operations that can be applied on the selected nodes...

The Inside Story of the Kelihos Botnet Takedown

Earlier this week, Microsoft released an announcement about the disruption of a dangerous botnet that was responsible for spam messages, theft of sensitive financial information, pump-and-dump stock scams and distributed denial-of-service attacks. Kaspersky Lab played a critical role in this botn...