DD-WRT 24-preSP2 - Information Disclosure

Exploit Title: DD-WRT Information Disclosure Vulnerability Date: 26-Dec-2010 Author: Craig Heffner, /dev/ttyS0 Software Link: http://www.dd-wrt.com Version: v24-preSP2 Tested on: builds 14311, 14896 Remote attackers can gain sensitive information about a DD-WRT router and internal clients,...

Mozilla Fixes Site Error-Handling Bug

Mozilla has fixed a bug in the way that its Bugzilla Web site and others handled certain errors, which could have been exploited to execute a man-in-the-middle attack against an unsuspecting user. The bug was related to the way that the sites responded to certain requests from client machines whe...

Hacking Millions of Routers by Craig Heffner

After attending several DEFCON events, I am thrilled to announce that I will be speaking at DEFCON 18. My presentation titled "How to Hack Millions of Routers" aims to shed light on prevalent security vulnerabilities. I will also take this opportunity to answer frequently asked questions and...

Java Multiple Issues

Hi all and sorry for cross post, after several months since I contacted Oracle informing them about ten issues on Java applet security, they finally released an Java 6 update 22 which fixes several security issues In particular the issues are the following, sorted by impact: Information Disclosur...

Old Wireless Security Flaws Still Haunting Networks

Wireless networks with open access points have become ubiquitous in the last few years as users have come to expect easy Internet access wherever they are. But as access has become more widely available the security of wireless networks has not come close to keeping pace, and as two talks at next...

Home Routers Open To DNS Rebinding Flaw

Millions of household routers are susceptible to a flaw that creates a handy means for hackers to hijack surfing sessions or hack into home networks. Read the full article. The Register...

Perforce Socket Hijacking Vulnerability

Perforce is prone to a vulnerability that allows attackers to hijack sockets. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description...

How to Get Owned in One Easy Step

As 2009 draws to a close, one thing has become clear: The most dangerous piece of software on your PC isn’t a banking Trojan or a bot; it’s your Web browser. The Web browser has become the main focal point of attackers’ attention and the frequency with which new vulnerabilities are found in all o...

Robert Hansen on DNS Rebinding Attacks and Browser Security

Dennis Fisher talks with security researcher Robert “Rsnake” Hansen about his recent work on DNS rebinding attacks, the poor state of browser security and his new book “Detecting Malice.” Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground podcast on...

DNS Rebinding Attacks Explained

Security researcher Robert “Rsnake” Hansen discusses the concept of DNS rebinding attacks and the threat they pose...

RHEL 3 / 4 / 5 : flash-plugin (RHSA-2007:1126)

An updated Adobe Flash Player package that fixes a security issue is now available for Red Hat Enterprise Linux 3 Extras, 4 Extras, and 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security Response Team. The flash-plugin package contains a...

RHEL 3 / 4 / 5 : flash-plugin (RHSA-2008:0221)

An updated Adobe Flash Player package that fixes several security issues is now available for Red Hat Enterprise Linux 3 Extras, Red Hat Enterprise Linux 4 Extras, and Red Hat Enterprise Linux 5 Supplementary. This update has been rated as having critical security impact by the Red Hat Security...

FreeBSD : cups -- remote code execution and DNS rebinding (736e55bc-39bb-11de-a493-001b77d09812)

Gentoo security team summarizes : The following issues were reported in CUPS : - iDefense reported an integer overflow in the cupsImageReadTIFF function in the 'imagetops' filter, leading to a heap-based buffer overflow CVE-2009-0163. - Aaron Siegel of Apple Product Security reported that the CUP...

cups -- remote code execution and DNS rebinding

Gentoo security team summarizes: The following issues were reported in CUPS: iDefense reported an integer overflow in the cupsImageReadTIFF function in the "imagetops" filter, leading to a heap-based buffer overflow CVE-2009-0163. Aaron Siegel of Apple Product Security reported that the CUPS web...

Gentoo Security Advisory GLSA 200904-20 (cups)

The remote host is missing updates announced in advisory GLSA 200904-20. OpenVAS Vulnerability Test $ Description: Auto generated from Gentoo's XML based advisory Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft Inc. http://www.securityspace.com Text descriptions are largely excerpted fr...

Gentoo Security Advisory GLSA 200904-20 (cups)

The remote host is missing updates announced in advisory GLSA 200904-20. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only...

Fedora Core 9 FEDORA-2009-3753 (cups)

The remote host is missing an update to cups announced via advisory FEDORA-2009-3753. OpenVAS Vulnerability Test $Id: fcore20093753.nasl 6624 2017-07-10 06:11:55Z cfischer $ Description: Auto-generated from advisory FEDORA-2009-3753 cups Authors: Thomas Reinke Copyright: Copyright c 2009 E-Soft...

Fedora Core 10 FEDORA-2009-3769 (cups)

The remote host is missing an update to cups announced via advisory FEDORA-2009-3769. Note: This VT has been deprecated and is therefore no longer functional. SPDX-FileCopyrightText: 2009 E-Soft Inc. Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the...

GLSA-200904-20 : CUPS: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-200904-20 CUPS: Multiple vulnerabilities The following issues were reported in CUPS: iDefense reported an integer overflow in the cupsImageReadTIFF function in the 'imagetops' filter, leading to a heap-based buffer overflow...

Design/Logic Flaw

The web interface for CUPS before 1.3.10 does not validate the HTTP Host header in a client request, which makes it easier for remote attackers to conduct DNS rebinding attacks...