Decades On, Buffer Overflows Still the Target

Buffer overflows have been a serious security problem for software developers for several decades now, but the history of exploitation research on this class of flaws is relatively short. Attackers and researchers originally focused on finding, fixing or exploiting buffer overflows on non-x86...

Taking Vendors to Task on Security Flaws

A loose consortium of security experts from more than 30 organizations today called on enterprises to exert more pressure on their software vendors to ensure that they use secure code development practices. Read the full article. Computerworld...

Patch Tuesday barrage: A bad case of amnesia

Yesterday was a perfect example of the lack of communication between software vendors and their customers about security. Three vendors released major patches for serious bugs, all within hours of each other. You would think that customers would be a high priority for all vendors, especially in...

It's time to revamp the automatic update

The automatic update is one of the more useful tools ever invented by software developers. Click a couple of buttons and you never have to worry about checking for new security updates again–it happens automagically! But it’s also one of the more frustrating and intrusive mechanisms we’ve seen in...

Vulnerability showboating is for amateurs

It’s like one of those magic candles people place on birthday cakes that sparkle and relight themselves each time you think they’ve been blown out. That’s how I’d define the most recent ignition of the “bugs for cash” debate. By now you’ll have probably heard that Dino Dai Zovi, Charlie Miller an...

openvpn207.txt

Hi, There is a flaw well more a stupid design than anything else in OpenVPN 2.0.7 and below in the the Remote Management Interface that allows an attacker to gain complete control because there is NO AUTHENTICATION YES NO AUTHENTICATION AT ALL!. This can be carried out from within the LAN that th...

upgrade.sendmail.8x.txt

Seems to me there's something really bad about software vendors. First of all, if author of program finds bug in it - even when this bug seems to be nasty - very often, he'll silently fix it, even without mentioning it in CHANGES blessed those who put there text like 'some security fixes', at lea...