RHEL 5 : bash (RHSA-2011:1073)

An updated bash package that fixes one security issue, several bugs, and adds one enhancement is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having low security impact. A Common Vulnerability Scoring System CVSS base score, which gives...

Symantec LiveUpdate Administrator Cross-Site Request Forgery

SUMMARY Symantecs LiveUpdate Administrator LUA is susceptible to a cross-site request forgery vulnerability which could result in the execution of HTML or script code in the context of the admins browser. AFFECTED PRODUCTS Product | Version | Solution ---|---|--- Symantec LiveUpdate Administrator...

ZDI-11-037: Symantec IM Manager Administrative Interface IMAdminSchedTask.asp Eval Code Injection Remote Code Execution Vulnerability

ZDI-11-037: Symantec IM Manager Administrative Interface IMAdminSchedTask.asp Eval Code Injection Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-11-037 January 31, 2011 -- CVE ID: CVE-2010-3719 -- CVSS: 8.5, AV:N/AC:M/Au:S/C:C/I:C/A:C -- Affected Vendors:...

Inside Patch Tuesday at the Microsoft Security Response Center

In this video, Dustin Childs of the Microsoft Security Response Center gives an inside look at what it’s like in Redmond on Patch Tuesday and what goes into the efforts that Microsoft makes to get fixes out every month. View the video at Microsoft’s Security TechCenter...

[security bulletin] HPSBGN02577 SSRT100224 rev.2 - 3Com OfficeConnect Gigabit VPN Firewall (3CREVF100-73), Remote Cross Site Scripting (XSS)

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c02507909 Version: 2 HPSBGN02577 SSRT100224 rev.2 - 3Com OfficeConnect Gigabit VPN Firewall 3CREVF100-73, Remote Cross Site Scripting XSS NOTICE: The information in this Security Bulletin should b...

Symantec Workspace Streaming Potential Unauthorized Downloads

SUMMARY Symantecs Workspace Streaming client fails to properly authenticate with the Symantec Workspace Streaming server when downloading files. This could potentially lead to unauthorized download of arbitrary code to a client system. AFFECTED PRODUCTS Products Affected Product | Version | Build...

Microsoft Re-Releases Security Update for MS10-025

Microsoft has re-released the security update related to Microsoft security bulletin MS10-025. This vulnerability affects Windows Media Services running on Windows 2000 Server. The original release of this update had been revoked last week because it did not effectively correct the underlying...

Exploit Code Published for Latest IE Zero-Day

Using obvious clues from a McAfee blog post, an Israeli hacker was able to pinpoint the latest Internet Explorer zero-day vulnerability and create working exploit code. The exploit code, which provides a clear roadmap to launch drive-by download attacks against IE 6 and IE 7 users, is being fitte...

SharePoint Server Cross Site Scripting

Hacktics Research Group Security Advisory http://www.hacktics.com/view=Resources%7CAdvisory By Irene Abezgauz, Hacktics. 22-Feb-2010 =========== I. Overview =========== During a penetration test performed by Hacktics' experts, a persistent cross-site scripting vulnerability was identified in the...

Symantec IM Manager Local-Access Cross-site Scripting

SUMMARY Symantecs IM Manager management console is susceptible to a cross-site scripting issue. AFFECTED PRODUCTS Product | Version | Solutions ---|---|--- Symantec IM Manager | 8.3 and 8.4 | Upgrade to 8.4.13 Note: Customers running 8.3 versions of Symantec IM Manager should upgrade to the lates...

ejabberd -- queue overload denial of service vulnerability

The Red Hat security response team reports: A remotely exploitable DoS from XMPP client to ejabberd server via too many "client2server" messages causing the message queue on the server to get overloaded, leading to server crash has been found...

Brad Arkin on Adobe Reader Zero-Day Flaws and Security Response

Dennis Fisher and Ryan Naraine talk with Brad Arkin, Adobe’s director of product security and privacy, about the new zero-day flaws in Acrobat and Reader, Adobe’s security response process and the challenges of getting updates to end users. Podcast audio courtesy of sykboy65 Subscribe to the...

[security bulletin] HPSBMA02481 SSRT090113 rev.1 - HP OpenView Data Protector Application Recovery Manager, Remote Denial

of Service DoS -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01943909 Version: 1 HPSBMA02481 SSRT090113 rev.1 - HP OpenView Data Protector Application Recovery Manager, Remote Denial of Service DoS NOTICE: The information in this Security...

Symantec’s Altiris Deployment and Notification Management Web Console RunCmd Vulnerability

SUMMARY Symantecs Altiris Deployment Solution, Notification Server and Symantec Management Platform web consoles install a vulnerable ActiveX control. Exploitation of one of the methods used by this control could possibly lead to unauthorized information disclosure, system information corruption ...

Symantec Norton Internet Security 2004 ActiveX Control Buffer Overflow

$Id$ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use. http://metasploit.com/framework/ require 'msf/core' class Metasploit3 'Symantec...

Symantec Altiris Deployment Solution and Notification Server Management Console FileDownload Vulnera

SUMMARY Symantecs Altiris Deployment Solution and Notification Server install a vulnerable ActiveX control. Exploitation of this issue could possibly lead to unauthorized information disclosure, system information corruption or potentially allow arbitrary code execution in the context of the user...

CentOS 3 : seamonkey (CESA-2009:1163)

Updated SeaMonkey packages that fix several security issues are now available for Red Hat Enterprise Linux 3 and 4. This update has been rated as having critical security impact by the Red Hat Security Response Team. SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat...

Apache Tomcat JK Connector: Information disclosure

Background The Apache Tomcat JK Connector aka modjk connects the Tomcat application server with the Apache HTTP Server. Description The Red Hat Security Response Team discovered that modjk does not properly handle 1 requests setting the "Content-Length" header while not providing data and 2 clien...

Adobe gets its own quarterly Patch Day

Borrowing a few pages from Microsoft’s playbook, Adobe today announced plans for a quarterly Patch Day for its Reader/Acrobat product lines and new initiatives to beef up its code hardening and security response processes. Starting this summer, Adobe Reader and Acrobat security patches will be...

CentOS 3 / 4 : wireshark (CESA-2006:0726)

New Wireshark packages that fix various security vulnerabilities are now available. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Wireshark is a program for monitoring network traffic. Several flaws were found in Wireshark's HTTP, WBXML, LDAP...