Nmap NSE 6.01: dns-zone-transfer

Requests a zone transfer AXFR from a DNS server. The script sends an AXFR query to a DNS server. The domain to query is determined by examining the name given on the command line, the DNS server's hostname, or it can be specified with the dns-zone-transfer.domain' script argument. If the query is...

STARTTLS vulnerability in different mail applications

Atacker can inject cleartext commands before TLS phase...

Scientific Linux Security Update : yum-autoupdate update on SL5.x, SL6.x i386/x86_64 (20120925)

The Scientific Linux team was made aware of a problem with the use of temp files in the yum-autoupdate script by Elias Persson. The problem should be corrected in these packages. These packages also include some minor feature updates for each release. For SL5, the script now includes the 'PRERUN'...

Design/Logic Flaw

OpenTTD 0.3.5 through 1.1.4 allows remote attackers to cause a denial of service game pause by connecting to the server and not finishing the 1 authorization phase or 2 map download, aka a "slow read" attack...

CVE-2012-0048

OpenTTD 0.3.5 through 1.1.4 allows remote attackers to cause a denial of service game pause by connecting to the server and not finishing the 1 authorization phase or 2 map download, aka a "slow read" attack...

New Trojan Spreading On App Store and Google Play

A new Trojan that uploads users’ phonebooks to a remote server is making the rounds, circulating on both Apple’s App Store and the Google Play marketplaces, according to research by Kaspersky Lab posted on the Securelist web site earlier today. Kaspersky virus researchers, responding to a request...

RHEL 4 : redhat-release (EOL Notice) (RHSA-2012:0349)

Red Hat Enterprise Linux 4 reaches end of Production Phase and transitions to Extended Life Phase. On March 01, 2012, all Red Hat Enterprise Linux 4-based products listed below transition from the Production Phase to the Extended Life Phase : Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux...

spamdyke -- STARTTLS Plaintext Injection Vulnerability

Secunia reports: The vulnerability is caused due to the TLS implementation not properly clearing transport layer buffers when upgrading from plaintext to ciphertext after receiving the "STARTTLS" command. This can be exploited to insert arbitrary plaintext data e.g. SMTP commands during the...

Nmap NSE net: informix-tables

Retrieves a list of tables and column definitions for each database on an Informix server. SYNTAX: informix.instance: specifies the Informix instance to connect to informix-query.username: The username used for authentication informix-query.password: The password used for authentication Version 0...

Plaintext injection in STARTTLS (multiple implementations)

This is a writeup about a flaw that I found recently, and that existed in multiple implementations of SMTP Simple Mail Transfer Protocol over TLS Transport Layer Security including my Postfix open source mailserver. I give an overview of the problem and its impact, how to find out if a server is...

POP3 Service STLS Plaintext Command Injection

The remote POP3 service contains a software flaw in its STLS implementation that could allow a remote, unauthenticated attacker to inject commands during the plaintext protocol phase that will be executed during the ciphertext protocol phase. Successful exploitation could allow an attacker to ste...

STARTTLS plaintext command injection vulnerability

Overview Some STARTTLS implementations could allow a remote attacker to inject commands during the plaintext phase of the protocol. Description STARTTLS is an extension to plaintext communication protocols that offers a way to upgrade a plaintext connection to an encrypted TLS or SSL connection...

CVE-2010-4354

The CVE covers a vulnerability in Cisco VPN products where remote attackers could enumerate valid VPN group names by sending an IKE Aggressive Mode packet with the group name in the ID field. Affected devices include ASA 5500 series, PIX 500 series, and VPN Concentrators 3000 series. Root cause i...

NiX : A Linux Brute Forcer Download

NiX Brute Forcer is a tool that uses brute force in parallel to log into a system without having authentication credentials beforehand. This tool is intended to demonstrate the importance of choosing strong passwords. The goal of NiX is to support a variety of services that allow remote...

With the FindBugs code analysis vulnerability-vulnerability warning-the black bar safety net

Static analysis tools promise without developer effort will be able to find out the code has some defects. Of course, if you have years of writing experience, you will know that these promises are not necessarily fulfilled. Nevertheless, a good static analysis tool is still in the Toolbox...

(RHSA-2010:0451) Low: Red Hat Certificate System 7.1 - End of Life Notice

On June 7, 2010, per the life-cycle support policy, version 7.1 of Red Hat Certificate System will exit Production Phase 2, marking the end of its support by Red Hat. Please reference the support policy here: https://www.redhat.com/security/updates/certificate/ For migration planning, please note...

CVE-2010-0392

Stack-based buffer overflow in vpnconf.exe in TheGreenBow IPSec VPN Client 4.51.001, 4.65.003, and possibly other versions, allows user-assisted remote attackers to execute arbitrary code via a long OpenScriptAfterUp parameter in a policy .tgb file, related to "phase 2."...

The wind phase with the guestbook v3. 2 build 0 9 1 2 0 1 vulnerability-vulnerability warning-the black bar safety net

Wind phase with the guestbook v3. 2 build 0 9 1 2 0 1 multiple vulnerabilities Download Script : http://down.chinaz.com/soft/22331.htm Author : bl4ck Contact : bl4ck4tlivedotcn Blog : http://user.qzone.qq.com/271174530 Dork : No DoRk f0R ScRipT KiDDieS Description : This system is new to write...

CVE-2009-2868

Unspecified vulnerability in Cisco IOS 12.2 through 12.4, when certificate-based authentication is enabled for IKE, allows remote attackers to cause a denial of service Phase 1 SA exhaustion via crafted requests, aka Bug IDs CSCsy07555 and CSCee72997...

Microsoft Releases New SDL Security Tools

Microsoft’s Security Development Lifecycle SDL team has released two new security tools to help developers test and verify the security of software programs. The tools — BinScope Binary Analyzer and MiniFuzz File Fuzzer — are available for download at no cost. The BinScope Binary Analyzer can be...