Silently Pwning Protected-Mode IE9 and Innocent Windows Applications

Our advanced binary planting research goes on... and it's time to reveal some interesting hacks, for instance how to exploit binary planting or DLL hijacking, if you prefer the less suitable term to execute remote malicious code through Internet Explorer 9 in protected mode on Windows 7 - without...

Microsoft warns against hacked Windows Phone 7 updates !

Microsoft is sorry, quite sorry indeed, that so many Windows Phone 7 owners have yet to receive the NoDo update for their handset. In a weekly written update today, the Windows Phone 7 team expressed sympathy to owners frustrated over the lag in receiving the update: "You want the latest technolo...

The Problem of Issuing Certs For Unqualified Names

The recent attack on Comodo and several of its associated registration authorities has spurred quite a bit of re-examination of the way that the Web’s certificate authority infrastructure works–or doesn’t. One interesting result of this work is that the folks at the Electronic Frontier Foundation...

U.S. Military's Cyber Chief Warns Of Eroding Technical Prowess

SAN FRANCISCO — The U.S. Military’s top officer in charge of cyber security said that the country must invest more in so-called “STEM” programs – science, technology, engineering and math – to avoid being outflanked in a world where cyber offensive- and defensive operations are the keys to milita...

Georgia Tech SQL Injection

Georgia Tech Multiple SQL Injection Vulnerabilities ..,--....,'. .b--. /; .. \ \ . ,. =,-,-' ----,..'--,..'-.;.' Disclosure by: cats Domain: gatech.edu 1 Description 2 Extracted sample data 3 Vulnerabilities and details 1 Description A large amount of vulnerabilities have been found in just about...

Fedora Update for tor FEDORA-2010-19159

Check for the Version of tor OpenVAS Vulnerability Test Fedora Update for tor FEDORA-2010-19159 Authors: System Generated Check Copyright: Copyright c 2010 Greenbone Networks GmbH, http://www.greenbone.net This program is free software; you can redistribute it and/or modify it under the terms of...

Non-secure content warning in IE8 on the Dashboards screen caused by the wiki renderer

Wiki renderer-generated contents e.g. in the activity stream include references to icons with http prefix that cause IE8 to generate security warnings for JIRA instances accessible via HTTPS. To reproduce it, have contents in the activity stream gadget contain icons included by the wiki renderer,...

Fedora 13 : php-pear-CAS-1.1.2-1.fc13 (2010-12258)

Security fixes Fix a session hijacking hole CVE-2010-2795 PHPCAS-61 callbackurl in proxy mode should be urlencoded, possible XSS CVE-2010-2796 PHPCAS-67 Bug fixes Fix warnings for SAML responses without attributes PHPCAS-59 Fix duplicate SAML debug output PHPCAS-64 Providing a new ST/PT/SA during...

Mandriva Linux Security Advisory : mysql (MDVSA-2010:155-1)

Multiple vulnerabilities has been found and corrected in mysql : MySQL before 5.1.48 allows remote authenticated users with alter database privileges to cause a denial of service server crash and database loss via an ALTER DATABASE command with a mysql50 string followed by a . dot, .. dot dot, .....

Fedora 12 : systemtap-1.1-1.fc12 (2010-0688)

Fixes CVE-2009-4273 Bugzilla 550172: https://bugzilla.redhat.com/showbug.cgi?id=CVE-2009-4273 New upstream release containing new features and bug fixes: better support for gcc 4.5 richer DWARF debuginfo, new preprocessor conditional for kernel 'CONFIG' testing, improved experimental unprivileged...

Fedora 13 : beanstalkd-1.4.6-1.fc13 (2010-9570)

Sat Jun 5 2010 Jeremy Hinegardner - 1.4.6-1 - update to upstream 1.4.6 - Mon Feb 22 2010 Jeremy Hinegardner - 1.4.3-2 - fix binlogdir location initialization for bug 55831 - Sun Feb 21 2010 Jeremy Hinegardner - 1.4.3-1 - update to upstream 1.4.3 - change default binlogdir in sysconfig file -...

Fedora 12 : spamass-milter-0.3.1-18.fc12 (2010-5096)

This update includes a fix for a problem where if the milter is running using the '-x' option to expand aliases before passing inbound mail through SpamAssassin, a malicious client using a carefully-crafted SMTP session could execute arbitrary code on the mail server. The fix avoids the use of a...

Fedora 12 : beanstalkd-1.4.6-1.fc12 (2010-9656)

Sat Jun 5 2010 Jeremy Hinegardner - 1.4.6-1 - update to upstream 1.4.6 - Mon Feb 22 2010 Jeremy Hinegardner - 1.4.3-2 - fix binlogdir location initialization for bug 55831 - Sun Feb 21 2010 Jeremy Hinegardner - 1.4.3-1 - update to upstream 1.4.3 - change default binlogdir in sysconfig file -...

Uebimiau Webmail 2.7.2 Cross Site Scripting / Path Disclosure

Exploit Title: Uebimiau Webmail | www.DigitalWhisper.co.il Software Link: http://www.uebimiau.org/ Version: = 2.7.2 Tested on: PHP Cross Site Scripting Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web...

Uebimiau Webmail 2.7.2 - Multiple Vulnerabilities

Exploit Title: Uebimiau Webmail | www.DigitalWhisper.co.il Software Link: http://www.uebimiau.org/ Version: = 2.7.2 Tested on: PHP Cross Site Scripting Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web...

US Tax Season Phishing Scams and Malware Campaigns

In the past, US-CERT has received reports of an increased number of phishing scams and malware campaigns that take advantage of the United States tax season. Due to the upcoming tax deadline, US-CERT reminds users to remain cautious when receiving unsolicited email that could be part of a potenti...

Firefox Gets Browser Boost From IE Attacks

Mozilla yesterday reported a “huge increase” in downloads of Firefox in Germany after that country’s computer security agency urged users of Microsoft’s Internet Explorer to dump the browser and run a rival instead. Read the full article. Computerworld...

Firefox 3.0.14 Insufficient warning for PKCS11 module installation and removal

Mozilla Firefox before 3.0.14 does not properly implement certain dialogs associated with the 1 pkcs11.addmodule and 2 pkcs11.deletemodule operations, which makes it easier for remote attackers to trick a user into installing or removing an arbitrary PKCS11 module...

Security fix for the ALT Linux 5 package libxml2 version 1:2.7.3-alt2

Aug. 17, 2009 Dmitry V. Levin 1:2.7.3-alt2 - Applied FICORA 245608 patches for CVE-2009-2414 and CVE-2009-2416. - xmlversion.h: Removed ATTRIBUTEPRINTF redefinition. - Fixed some compiler warnings...

Security fix for the ALT Linux 9 package libxml2 version 1:2.7.3-alt2

Aug. 17, 2009 Dmitry V. Levin 1:2.7.3-alt2 - Applied FICORA 245608 patches for CVE-2009-2414 and CVE-2009-2416. - xmlversion.h: Removed ATTRIBUTEPRINTF redefinition. - Fixed some compiler warnings...