Chris Hoff at SecTor 2009: Cloud Security

In his keynote presentation at SecTor 2009, Chris Hoff of Cisco discusses the rise of public and private cloud services, as well as the threats to those platforms...

Q&A: Amit Yoran

Amit Yoran, CEO of NetWitness, is the former director of the National Cyber Security Division at the Department of Homeland Security and a longtime veteran of the security industry both inside and outside the Beltway. He spoke with Dennis Fisher recently about the current power vacuum in Washingt...

ZDI-09-064: Apple QuickTime FlashPix Sector Size Overflow Vulnerability

ZDI-09-064: Apple QuickTime FlashPix Sector Size Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-064 September 10, 2009 -- CVE ID: CVE-2009-2798 -- Affected Vendors: Apple -- Affected Products: Apple Quicktime -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

Apple QuickTime FlashPix Sector Size Overflow Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple QuickTime. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists during the parsing of...

It is Time for Obama to Move on Cybersecurity Job

In his short time in office, Barack Obama has moved swiftly to address many of the problems facing the country: the financial crisis, the impending death of the auto industry and the lack of a playoff system in college football. But, despite his reassurances at a press conference in May, Obama ha...

Private sector relations should be job one for cyber security czar

Whoever is brave enough to fill the soon-to-be-created cybersecurity czar position will find a rather large pile of challenges waiting. Among them will be dealing with a confused and argumentative Congress, doing a full-scale assessment of the country’s critical infrastructure and reaching out to...

Cybersecurity czar position, 60-day review report coming this week

From The Washington Post Ellen Nakashima The Obama administration is set to announce the creation of a new high-level position to run the cybersecurity program for the country. The announcement is expected on Friday, along with the release of the report on the administration’s 60-day review of th...

Feds should let private sector lead on cybersecurity

From SearchSecurity.com Eric Ogren The federal government has whipped itself into a frenzy on the issue of cybersecurity recently, as evidenced by the numerous competing bills in the House and Senate and the high-level wrangling over which agency should run cybersecurity. Washington certainly has...

Defense Industrial Base information-sharing program a good start

The recent flood of stories on attacks against the electrical grid, various government agencies and other portions of the critical infrastructure has renewed the calls for improvements in federal cybersecurity and, especially, information sharing between the government and the private sector on...

U.S. Should Play Larger Role in Securing Internet, Hathaway Says

In her much anticipated talk, acting senior director for cyberspace by President Obama, Melissa Hathaway generally reviewed what we already knew, and what has been previously reported when it comes to federal cyber security: The White House should coordinate IT security efforts; private sector...

Bad outweighs the good in Senate cybersecurity bill

The Senate bill introduced earlier this month that would make sweeping changes to the way that information security is practiced both in the federal government and the private sector has a number of good elements, but the flaws in the proposed legislation outweight the benefits, writes Steve...

Design/Logic Flaw

Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.2 have unknown impact and attack vectors related to 1 Public Sector Human Resources APP03 and 2 Quoting component APP06...

CVE-2007-5528

Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.2 have unknown impact and attack vectors related to 1 Public Sector Human Resources APP03 and 2 Quoting component APP06...

CVE-2007-5528

CVE-2007-5528 is linked to concrete details in related records: Oracle E-Business Suite 11/12 vulnerabilites (notably CVE-2007-5766) describe an SQL injection in okxLOV.jsp for 11 and 12, enabling remote execution of arbitrary SQL via unknown vectors. The 12.0.2 entry mentions unknown impact/atta...

CVE-2007-5528: Undefined Security Weakness

Multiple unspecified vulnerabilities in Oracle E-Business Suite 12.0.2 have unknown impact and attack vectors related to 1 Public Sector Human Resources APP03 and 2 Quoting component APP06...

RHEL 4 : util-linux (RHSA-2007:0235)

An updated util-linux package that corrects a security issue and fixes several bugs is now available. This update has been rated as having low security impact by the Red Hat Security Response Team. The util-linux package contains a collection of basic system utilities. A flaw was found in the way...

CVE-2005-4075

Multiple cross-site scripting XSS vulnerabilities in index.cfm in CFNuke 4.6 and earlier allow remote attackers to inject arbitrary web script or HTML via the 1 topic and 2 newsid parameter in the news sector, and 3 cat parameter in the links sector...

icsa.certified.weak.crypto.txt

Date: Thu, 27 May 1999 00:24:26 -0700 From: Lucky Green To: [email protected] Subject: ICSA certifies weak crypto as secure I am becoming concerned about the apparent lack of professional competence within even well-known segments of the security community. I hope the incident I discovered is ...