VxWorks Debugging Service Security Bypass Vulnerability

VxWorks is prone to a remote security bypass vulnerability. SPDX-FileCopyrightText: 2011 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Linux Foundation Says UEFI Doesn't Have to Prevent Other OS Installations

The Linux Foundation has released a document outlining ways in which the UEFI secure boot specification can be used to support the installation of Linux and other open operating systems on UEFI-enabled hardware. As long as hardware vendors set up their systems in the proper way, UEFI should be no...

India Seizes Equipment Linked to Duqu Attack

Officials in India have seized components from a server as part of an investigation into the Duqu Trojan, according to a report. According to Reuters, two workers at Web Werks, a web hosting company based in Mumbai, said the country’s Department of Information Technology took the equipment after...

The Hacker's Choice releases SSL DOS Tool

The Hacker's Choice releases SSL DOS Tool German hacker group "The Hacker's Choice" officially released a new DDoS tool. The tool exploits a weakness in SSL to kick a server off the Internet. Establishing a secure SSL connection requires 15x more processingpower on the server than on the...

The Mystery of Duqu

First of all, we feel it necessary to clarify some of the confusion surrounding the files and their names related to this incident. To get a full understanding of the situation you only need to know that we’re talking about just two malicious programs here at a minimum – the main module and a...

VUPEN Security Research - Google Chrome WebKit Engine Child Tag Deletion Stale Pointer Vulnerability

VUPEN Security Research - Google Chrome WebKit Engine Child Tag Deletion Stale Pointer Vulnerability Website : http://www.vupen.com/english/research.php Twitter : http://twitter.com/vupen I. BACKGROUND --------------------- "Google Chrome is a web browser developed by Google that uses the WebKit...

SSL/TLS Protocol Vulnerability

US-CERT is aware of a vulnerability affecting the Secure Socket Layer SSL and Transport Layer Security TLS protocols. Exploitation of this vulnerability may allow an attacker to decrypt encrypted SSL/TLS traffic and obtain sensitive information. Microsoft has released Security Advisory 2588513 to...

Adobe Says It Is Breaking Ties To Diginotar

Software giant Adobe said on Thursday that it was removing Diginotar’s Qualified CA certificate from the Adobe Approved Trust List AATL, according to a company blog post. The move would effect Adobe Reader and Adobe Acrobats Versions 9 and X. It is just the latest move by major software vendors t...

DigiNotar Hacker Says He Has GlobalSign Database Backups, Other Data

As GlobalSign continues the investigation into the claimed compromise of its CA infrastructure, the attacker who says he breached DigiNotar and Comodo said in another message on Pastebin Wednesday that not only did he hack GlobalSign, but he has the private key used to sign the certificate for th...

Are Some Certificate Authorities Too Big To Fail?

In the wake of this weekend’s revelations of the seriousness of the attack on certificate authority DigiNotar, security experts have renewed criticism of the Internet’s digital certificate infrastructure, with some wondering if larger certificate authorities CAs might be too big to fail...

DigiNotar Says Its CA Infrastructure Was Compromised

VASCO, the parent company of DigiNotar, says that the fraudulent certificate for Google’s domains that the certificate authority issued was just one of many such bogus certificates it handed out in recent months, and blamed the growing scandal on an attack on its CA infrastructure. In a statement...

MS 2562937: Update Rollup for ActiveX Kill Bits (2562937)

The remote Windows host is missing a list of kill bits for ActiveX controls that are known to contain vulnerabilities. If these ActiveX controls are ever installed on the remote host, either now or in the future, they would expose it to various security issues. Note that the affected controls are...

Sify.com hacked with SQL Injection Vulnerability

Sify.com hacked with SQL Injection Vulnerability Sify's website contain SQL injection Vulnerability and Hackers are able to Database Access, Database Dump, Possibility of shell uploading. Sify is one of India's leading integrated Information Communications Technology companies. Sify was one of th...

Federal CIO Criticizes Gov't Contractors, Urges Consolidation of Data Centers

Federal Chief Information Officer Vivek Kundra warned of “an IT cartel” of vendors in a discussion with President Barack Obama and his scientific advisors on Friday, according to a report from Network World. During a talk with the President’s Council of Advisors on Science and Technology PCAST,...

Microsoft Offers $250k Reward for Rustock Information

Microsoft is now offering a $250,000 reward to help track down the people behind the notorious Rustock botnet. The company, which helped take down the botnet several months ago, said that it already has some good information on the crew behind the network and is now looking for information to bri...

Mozilla Firefox 5.0 / Microsoft Internet Explorer 8.0 Denial Of Service

Firefox 5.0 & Internet Explorer 8.0 - Access Violation Exception and Unknown Exception Exploit Title: Firefox 5.0 & Internet Explorer 8.0 - Access Violation Exception and Unknown Exception Google Dork: N/A Date: 7/12/2011 Author: r45c4l Software Link: www.firefox.com and IE is shiped with Windows...

Internet System Consortium releases BIND Patches

The Internet System Consortium has released updates for BIND to address multiple vulnerabilities. CVE-2011-2464 affects the following versions: 9.6.3; 9.6-ESV-R4 and later; 9.7.0 and later; 9.7.1 and later; 9.7.2 and later; 9.7.3 and later; 9.7.4b1; 9.8.0 and later; and 9.8.1b1. CVE-2011-2465...

Multiple ActiveX components security vulnerabilities

kill bit update for multiple components of different vendors...

MS11-027: Cumulative Security Update of ActiveX Kill Bits (2508272)

The remote Windows host has one or more ActiveX controls installed that could be abused to execute arbitrary code remotely if a user can be tricked into viewing a malicious web page using Internet Explorer. Three of these controls are from Microsoft itself while the others are from third-party...

Hacker group defies U.S. law, defends exposing McAfee vulnerabilities !

The hacker group that exposed holes in McAfee's website knows it's breaking U.S. law, but vows to continue exposing vulnerabilities, especially on security vendor websites. The hacker group that exposed holes in McAfee's website knows it's breaking U.S. law, but vows to continue exposing...