9022 matches found
Facebook Game - Zynga's Cafe World Detected (deprecated)
Binary data 6358.prm...
Facebook Game - Zynga's Indiana Jones Adventure World Detected (deprecated)
Binary data 6365.prm...
Facebook Game - Wooga Monster World Detected (deprecated)
Binary data 6380.prm...
kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images
The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, uses world-readable permissions for vmcore files, which allows local users to obtain sensitive information by inspecting the file...
CVE-2011-3479
Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 aka 12.5.x and 7.1 aka 12.6.x, uses world-writable permissions for product-installation files, which allows local users to gain privileges by modifying a file...
Design/Logic Flaw
Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 aka 12.5.x and 7.1 aka 12.6.x, uses world-writable permissions for product-installation files, which allows local users to gain privileges by modifying a file...
CVE-2011-3479
Symantec pcAnywhere 12.5.x through 12.5.3, and IT Management Suite pcAnywhere Solution 7.0 aka 12.5.x and 7.1 aka 12.6.x, uses world-writable permissions for product-installation files, which allows local users to gain privileges by modifying a file...
Reading material
Stuxnet expert and industry gadfly Ralph Langner was in attendance at S4 this year, as he has been in past years. This year, however, Langner had a new book to promote: Robust Control System Networks – a kind of call to arms for the industrial control sector to respond to a ‘post Stuxnet’ world...
MySQL < 3.22 Readable Logs
The version of MySQL installed on the remote host reportedly creates world-readable log files, thus allowing local users to get sensitive information, such as the passwords for newly created users. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid17815;...
World Economic Forum Sees Dark Side To Connectivity
The latest edition World Economic Forum’s Global Risks Report takes a dim view of our hyper connected world. At the group’s annual meeting in Davos, Switzerland, members wrestled with the consequences of ubiquitous Internet connectivity, concluding that groups or individuals with few resources ar...
Fedora 16 : ipmitool-1.8.11-8.fc16 (2011-17065)
This update fixes following security bug: CVE-2011-4339 - OpenIPMI: IPMI event daemon creates PID file with world writeable permissions Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatical...
NachoRoot
On ASUS Transformer Pime /data/sensors/AMI304Config.ini is set world writable on boot and so a /data/local.prop symlink attack can be mounted...
Microsoft to Release Emergency Fix for ASP.NET DoS Flaw
UPDATED Microsoft on Thursday plans to release an emergency out-of-band update to address a vulnerability in ASP.NET that could allow an attacker to consume all of the resources on a vulnerable server with a single specially designed HTTP request. The vulnerability affects a wide range of Web...
RHEL 6 : ipmitool (RHSA-2011:1814)
The remote Redhat Enterprise Linux 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2011:1814 advisory. The ipmitool package contains a command line utility for interfacing with devices that support the Intelligent Platform Management Interface IPMI...
OpenIPMI: IPMI event daemon creates PID file with world writeable permissions
ipmievd aka the IPMI event daemon in OpenIPMI, as used in the ipmitool package 1.8.11 in Red Hat Enterprise Linux RHEL 6, Debian GNU/Linux, Fedora 16, and other products uses 0666 permissions for its ipmievd.pid PID file, which allows local users to kill arbitrary processes by writing to this fil...
Paul Judge on Clicks For Meals and Social Network Security
Dennis Fisher talks with Paul Judge of Barracuda Networks about the company’s Clicks For Meals program, which is aiming to provide 10,000 meals during the holidays through the World Food Programme. Podcast audio courtesy of sykboy65 Subscribe to the Digital Underground podcast on...
kexec-tools: Multiple security flaws by management of kdump core files and ramdisk images
The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, uses world-readable permissions for vmcore files, which allows local users to obtain sensitive information by inspecting the file...
glibc LD_AUDIT Privilege Escalation
!/bin/sh I Can't Read and I Won't Race You Either by zx2c4 This is an exploit for CVE-2010-3856. A while back, Tavis showed us three ways to exploit flaws in glibc's dynamic linker involving LDAUDIT. 1 2 The first way involved opening a file descriptor and using fexecve to easily win a race with...
Teens' Murderers Leave Online Trail 1.4 Billion Pages Long
Vanity Fair reports that two British Columbia teens convicted of first degree murder used World of Warcraft to plot the rape and murder of a close friend. The result: a trail of online evidence 1.4 billion pages long. Its common knowledge that our increasing reliance on the Internet to communicat...