Researchers Uncover Spying Tool Used by Governments to Hijack all Types of Smartphones

Purchasing malware to victimize people is illegal by laws but if the same thing any government official do, then its not!! Yes, the police forces around the World are following the footsteps of U.S. National Security Agency NSA and FBI. Researchers from the Citizen Lab at the Munk School of Globa...

Dramatic Drop in Vulnerable NTP Servers Used in DDoS Attacks

While patching of webservers vulnerable to the Heartbleed OpenSSL bug may have stalled, the same cannot be said about repairs to NTP servers that could be leveraged in devastating amplification attacks. A spate of distributed denial-of-service attacks DDoS tore through companies in January and...

Multiple PHP Servers WeevelyShell Backdoor Command Execution

A command execution vulnerability has been reported in multiple PHP servers. The vulnerability is due to the existence of a backdoor file on the PHP server within a specific library. A remote attacker can exploit this vulnerability by sending a request to the malicious backdoor file...

DNS Flood DDoS Attack Hit Video Gaming Industry with 90 Million Requests per Second

Hackers are leveraging large number of compromised machines a botnet network to carry out massive DNS Flood DDoS attack against a large Video Gaming Industry website, peaking above 110 Gbps. A US based security solutions provider Incapsula, is protecting a famous Video Gaming website from this hi...

BMC Vulnerability Exposes Admin Password of 32,000 Servers in Plaintext on the Internet

A Flaw has been discovered in the motherboards manufactured by the server manufacturer Supermicro, has left more than 30,000 servers vulnerable to hackers that could allow them to remotely compromise the management interface of unpatched servers. The vulnerability actually resides in the Baseboar...

CVE-2014-4049

Heap-based buffer overflow in the phpparserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service crash and possibly execute arbitrary code via a crafted DNS TXT record, related to the dnsgetrecord function...

CVE-2014-4049

Heap-based buffer overflow in the phpparserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service crash and possibly execute arbitrary code via a crafted DNS TXT record, related to the dnsgetrecord function...

GLSA-201406-09 : GnuTLS: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201406-09 GnuTLS: Multiple vulnerabilities Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers referenced below for details. Impact : A remote attacker could utilize multiple vectors to spoof...

SSL Pulse Scans Quantify Vulnerable OpenSSL Servers

Certain mitigating factors made the recent OpenSSL man-in-the-middle vulnerability a notch or two below Heartbleed in terms of criticality. With that in consideration, it’s probably no surprise that patching levels for CVE-2014-0224 aren’t as high out of the gate as they were for Heartbleed. Ivan...

ISC Patches Critical DoS Vulnerability in BIND

A critical, remotely exploitable bug in some BIND domain name system DNS servers could cause a denial of service situation and trigger them to crash. The defect lies in the extension mechanisms for DNS EDNS specification, the Internet Systems Consortium, which performs upkeep on the system,...

openSUSE Security Update : whois (openSUSE-SU-2013:1670-1)

update to 5.0.26 bnc848594 - Added the .cf TLD server. - Updated the .bi TLD server. - Added a new ASN allocation. - includes changes from 5.0.25 - Added the .ax, .bn, .iq, .pw and .rw TLD servers. - Updated one or more translations. - includes updates changes 5.0.24 : - Merged documentation...

openSUSE Security Update : libopenssl-devel (openSUSE-SU-2010:0965-2)

Multithreaded OpenSSL servers using the TLS server extension are vulnerable to a buffer overrun attack CVE-2010-3864. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update libopenssl-devel-3562. The...

openSUSE Security Update : krb5-appl (openSUSE-2012-17)

Fixed a remote code execution in ktelnetd CVE-2011-4862 / bnc738632 %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from openSUSE Security Update openSUSE-2012-17. The text description of this plugin is C SUSE LLC...

openSUSE Security Update : telepathy-gabble (openSUSE-SU-2013:1013-1)

This update of telepathy-gabble fixes a TLS bypass problem. Changes in telepathy-gabble : - Add telepathy-gabble-cve-2013-1431.patch bnc822586. This makes it respect the TLS-required flag on legacy Jabber servers. Identified as CVE-2013-1431. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. T...

GnuTLS: Multiple vulnerabilities

Background GnuTLS is an Open Source implementation of the TLS 1.2 and SSL 3.0 protocols. Description Multiple vulnerabilities have been discovered in GnuTLS. Please review the CVE identifiers referenced below for details. Impact A remote attacker could utilize multiple vectors to spoof arbitrary...

VMware Patches ESXi Against OpenSSL Flaw, But Many Other Products Still Vulnerable

While the group of vulnerabilities that the OpenSSL Project patched last week hasn’t grown into the kind of mess that the Heartbleed flaw did, the vulnerabilities still affect a huge range of products. Vendors are still making their way through the patching process, and VMware has released an...

VMSA-2014-0006 : VMware product updates address OpenSSL security vulnerabilities

a. OpenSSL update for multiple products. OpenSSL libraries have been updated in multiple products to versions 0.9.8za and 1.0.1h in order to resolve multiple security issues. The Common Vulnerabilities and Exposures project cve.mitre.org has assigned the names CVE-2014-0224, CVE-2014-0198,...

[SECURITY] Fedora 20 Update: mediawiki-1.21.10-1.fc20

MediaWiki is the software used for Wikipedia and the other Wikimedia Foundation websites. Compared to other wikis, it has an excellent range of features and support for high-traffic websites using multiple servers This package supports wiki farms. Read the instructions for creating wiki instances...

[oss-security] FreeBSD Security Advisory FreeBSD-SA-14:13.pam

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-14:13.pam Security Advisory The FreeBSD Project Topic: Incorrect error handling in PAM policy parser Category: contrib Module: pam Announced: 2014-06-03 Credits...

CVE-2014-3466

Buffer overflow in the readserverhello function in lib/gnutlshandshake.c in GnuTLS before 3.1.25, 3.2.x before 3.2.15, and 3.3.x before 3.3.4 allows remote servers to cause a denial of service memory corruption or possibly execute arbitrary code via a long session id in a ServerHello message...