rsyslog security update

7.4.7-7.0.1 - use setsid to get a controlling session and process group Orabug: 17346261 Todd Vierling 7.4.7-7 - fix CVE-2014-3634 resolves: 1149152...

Ubuntu 14.04 LTS : Bash vulnerabilities (USN-2364-1)

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2364-1 advisory. Florian Weimer and Todd Sabin discovered that the Bash parser incorrectly handled memory. An attacker could possibly use this issue to bypass certain...

Debian DSA-3035-1 : bash - security update

Tavis Ormandy discovered that the patch applied to fix CVE-2014-6271 released in DSA-3032-1 for bash, the GNU Bourne-Again Shell, was incomplete and could still allow some characters to be injected into another environment CVE-2014-7169 . With this update prefix and suffix for environment variabl...

Pligg CMS (story.php?id) 1.0.4 - SQL Injection Vulnerability

No description provided by source. / ! Pligg CMS story.php?id SQL Injection Vulnerability ! Author : Don Tukulesto [email protected] ! Homepage: http://indonesiancoder.com ! Date : Tue, April 27, 2010 ! Tune in : http://antisecradio.fm choose your weapon / Software Information Vendor :...

Joomla com_jnewspaper (cid) SQL Injection Vulnerability

No description provided by source. / ! Joomla comjnewspaper cid SQL Injection Vulnerability ! Author : Don Tukulesto [email protected] ! Homepage : http://indonesiancoder.com ! Date : Tue, April 20, 2010 ! Tune in : http://antisecradio.fm choose your weapon / Software Information Vendor :...

Todd Miller Sudo 'validate_env_vars()'本地权限提升漏洞

BUGTRAQ ID: 65997 CVECAN ID: CVE-2014-0106 Sudo是允许系统管理员让普通用户执行一些或者全部的root命令的一个工具，减少了root用户的登陆和管理时间，提高了安全性。 sudo 1.6.9-1.8.4p5版本启用后envreset后，没有正确过滤某些环境变量，在实现上存在本地权限提升漏洞，本地攻击者可利用此漏洞以提升的权限运行任意命令。 0 Todd Miller Sudo 1.6.9 - 1.8.4p5 厂商补丁： Todd Miller ----------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：...

RedHat Update for sudo RHSA-2014:0266-01

The remote host is missing an update for the SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Oracle Linux 5 : sudo (ELSA-2014-0266)

The remote Oracle Linux 5 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2014-0266 advisory. 1.7.2p1-29 - added patch for CVE-2014-0106: certain environment variables not sanitized when envreset is disabled Resolves: rhbz1072210 Tenable has extracted th...

sudo security update

CentOS Errata and Security Advisory CESA-2014:0266 An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base...

Synology DiskStation Manager arbitrary file modification

Overview Synology DiskStation Manager versions 4.3-3776-3 and below contain a vulnerability that allows a remote unauthenticated user to append arbitrary data to an arbitrary file under root privileges. Description CWE-284: Improper Access Control - CVE-2013-6955Synology DiskStation Manager...

Exploiting GPS vulnerability to Hijack Ships, Airplanes with $3000 Equipments

The GPS expert Todd Humphreys, professors at the University of Texas, demonstrated that just using a cheap apparatus composed by a small antenna, an electronic GPS “spoofer” built in $3,000 and with a laptop, it is possible to exploit GPS vulnerability to obtain control of sophisticated navigatio...

PlayStation hacker gets year of House Arrest for destroying evidence of Hack

23-year-old Todd Miller, suspected of hacking into Sony's PlayStation Network, was due to be arrested, will spend a year on house arrest, but not for the hacking. Instead, he was sentenced yesterday in federal court for obstructing a federal investigation because he smashed his computers, halting...

PlayStation hacker gets year of House Arrest for destroying evidence of Hack

23-year-old Todd Miller, suspected of hacking into Sony’s PlayStation Network, was due to be arrested, will spend a year on house arrest, but not for the hacking. Instead, he was sentenced yesterday in federal court for obstructing a federal investigation because he smashed his computers, halting...

Amanda Todd blackmailer Kody Maxson outed another pedophile blackmailer

The hacker group Anonymous claims that Maxson is the man who drove Amanda Todd to her death last week, but the Canada native says it wasn't him and that he was a friend to the teen. Alleged Amanda Todd blackmailer Kody Maxson outed a second pedophile blackmailer, known as Viper. Maxson appeared i...

Anonymous identified cyber stalker who drove Amanda Todd to suicide

Hacker group Anonymous may have tracked down the sex-obsessed cyberbully who drove a 15-year-old girl to kill herself last week. Today Anonymous posted a video on YouTube naming a 32-year-old man from British Columbia, as the person responsible for the October 10th suicide of 15-year-old Amanda...

FreeBSD : sudo -- Secure path vulnerability (d42e5b66-6ea0-11df-9c8d-00e0815b8da8)

Todd Miller reports : Most versions of the C library function getenv return the first instance of an environment variable to the caller. However, some programs, notably the GNU Bourne Again SHell bash, do their own environment parsing and may choose the last instance of a variable rather than the...

CentOS 5 : sudo (CESA-2010:0361)

An updated sudo package that fixes one security issue is now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Sudo sudoedit路径解析本地权限提升漏洞

BUGTRAQ ID: 39468 CVE ID: CVE-2010-1163 Sudo是一款允许用户以其他用户权限安全的执行命令的程序，广泛使用在Linux和Unix操作系统下。...

sudo -- Privilege escalation with sudoedit

Todd Miller reports: Sudo's command matching routine expects actual commands to include one or more slash '/' characters. The flaw is that sudo's path resolution code did not add a "./" prefix to commands found in the current working directory. This creates an ambiguity between a "sudoedit" comma...

Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability

Exploit for unknown platform in category local exploits ==================================================================== Todd Miller Sudo 'sudoedit' Local Privilege Escalation Vulnerability ==================================================================== Vulnerable: Ubuntu Ubuntu Linux 9....