[security bulletin] HPSBMA02252 SSRT061258, SSRT061259 rev.1 - HP OpenView Storage Data Protector, Remote Arbitrary Code Execution

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 SUPPORT COMMUNICATION - SECURITY BULLETIN Document ID: c01124817 Version: 1 HPSBMA02252 SSRT061258, SSRT061259 rev.1 - HP OpenView Storage Data Protector, Remote Arbitrary Code Execution NOTICE: The information in this Security Bulletin should be acte...

Adobe to Patch Zero-Day Flaw on Jan 12

Here’s a quick update to the Adobe PDF Reader/Acrobat zero-day story that broke yesterday after the company confirmed that an unpatched vulnerabilities was being attacked in the wild. First up, an exploit has been fitted into the Metasploit point-and-click penetration testing tool and there are...

ZDI-09-098: Symantec Multiple Products VRTSweb.exe Remote Code Execution Vulnerability

ZDI-09-098: Symantec Multiple Products VRTSweb.exe Remote Code Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-098 December 9, 2009 -- CVE ID: CVE-2009-3027 -- Affected Vendors: Symantec -- Affected Products: Symantec Symantec Backup Exec Continuous Protection Server...

ZDI-09-096: Hewlett-Packard OpenView NNM nnmRptConfig.exe Template Variable vsprintf Overflow Vulnerability

ZDI-09-096: Hewlett-Packard OpenView NNM nnmRptConfig.exe Template Variable vsprintf Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-096 December 9, 2009 -- CVE ID: CVE-2009-3848 -- Affected Vendors: Hewlett-Packard -- Affected Products: Hewlett-Packard OpenView Network...

ZDI-09-094: Hewlett-Packard OpenView NNM Multiple Command Injection Vulnerabilities

ZDI-09-094: Hewlett-Packard OpenView NNM Multiple Command Injection Vulnerabilities http://www.zerodayinitiative.com/advisories/ZDI-09-094 December 9, 2009 -- CVE ID: CVE-2009-3845 -- Affected Vendors: Hewlett-Packard -- Affected Products: Hewlett-Packard OpenView Network Node Manager --...

ZDI-09-091: Hewlett-Packard Application Recovery Manager MSG_PROTOCOL Stack Overflow Vulnerability

ZDI-09-091: Hewlett-Packard Application Recovery Manager MSGPROTOCOL Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-091 December 8, 2009 -- CVE ID: CVE-2009-3844 -- Affected Vendors: Hewlett-Packard -- Affected Products: Hewlett-Packard Application Recovery Manage...

ZDI-09-097: Hewlett-Packard OpenView NNM nnmRptConfig.exe Template Variable strcat Overflow Vulnerability

ZDI-09-097: Hewlett-Packard OpenView NNM nnmRptConfig.exe Template Variable strcat Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-097 December 9, 2009 -- CVE ID: CVE-2009-3849 -- Affected Vendors: Hewlett-Packard -- Affected Products: Hewlett-Packard OpenView Network No...

MS to Patch Critical IE Zero-Day Flaw

Just two weeks after the release of exploit code for a critical remotely exploitable security hole in its Internet Explorer browser, Microsoft says a fix will be included in this month’s batch of Patch Tuesday updates. Microsoft has already issued an advisory to confirm the severity of the issue,...

Exploit Released for Adobe Illustrator Zero Day Flaw

Adobe’s security response team is scrambling to deal with the release of exploit code for what appears to be a critical zero-day flaw in the Adobe Illustrator CS4 software product. The vulnerability is caused due to an error in the parsing of Encapsulated Postscript Files .eps and can be exploite...

Serious Zero-Day Flaw Found in FreeBSD, Exploit Published

A researcher has published an explanation of a new flaw in FreeBSD that allows an attacker to take control of a vulnerable machine. The vulnerability could give an attacker root access to the FreeBSD machine, and the FreeBSD developers have published a patch for the flaw early Tuesday. The...

Some more details on IE STYLE zero-day

Here are a few more details on researching the IE STYLE zero-day vulnerability. Microsoft Security Advisory 977981 describes the vulnerability as follows: "The vulnerability exists as an invalid pointer reference of Internet Explorer. It is possible under certain conditions for a CSS/Style object...

New Zero-Day Flaw Discovered in IE7

There is a newly discovered vulnerability in both Internet Explorer 6 and Internet Explorer 7 that could enable an attacker to take complete control of a vulnerable machine. The vulnerability is the result of a dangling pointer in IE and there is a working exploit for the flaw circulating online...

ZDI-09-082: Microsoft Office Excel PivotTable Cache Record Parsing Memory Corruption Vulnerability

ZDI-09-082: Microsoft Office Excel PivotTable Cache Record Parsing Memory Corruption Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-082 November 10, 2009 -- CVE ID: CVE-2009-3127 -- Affected Vendors: Microsoft -- Affected Products: Microsoft Office Excel -- TippingPointTM IPS...

HP Power Manager Remote Code Execution

Added: 11/06/2009 CVE: CVE-2009-2685 BID: 36933 OSVDB: 59684 Background HP Power Manager is a web-based application that enables administrators to manage an HP UPS from a browser-based management console. Problem A stack-based buffer overflow in the HP Power Manager management web server allows...

Zero-Day Flaw Found in Web Encryption

A zero-day flaw in the TLS and SSL protocols, which are commonly used to encrypt web pages, has been made public. The flaw allows an outsider to hijack a legitimate user’s browser session and successfully impersonate the user, the researchers said in a technical paper. Read the full story...

ZDI-09-080: Sun Java Runtime Environment JPEGImageReader Heap Overflow Vulnerability

ZDI-09-080: Sun Java Runtime Environment JPEGImageReader Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-080 November 4, 2009 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- TippingPointTM IPS Customer Protection:...

ZDI-09-075: Novell eDirectory LDAP Null Base DN Denial of Service Vulnerability

ZDI-09-075: Novell eDirectory LDAP Null Base DN Denial of Service Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-075 November 2, 2009 -- Affected Vendors: Novell -- Affected Products: Novell eDirectory -- TippingPointTM IPS Customer Protection: TippingPoint IPS customers have be...

ZDI-09-077: Sun Java Web Start Arbitrary Command Execution Vulnerability

ZDI-09-077: Sun Java Web Start Arbitrary Command Execution Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-077 November 4, 2009 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

ZDI-09-078: Sun Java Runtime AWT setDifflCM Stack Overflow Vulnerability

ZDI-09-078: Sun Java Runtime AWT setDifflCM Stack Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-078 November 4, 2009 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- TippingPointTM IPS Customer Protection: TippingPoint IPS...

ZDI-09-079: Sun Java Runtime AWT setBytePixels Heap Overflow Vulnerability

ZDI-09-079: Sun Java Runtime AWT setBytePixels Heap Overflow Vulnerability http://www.zerodayinitiative.com/advisories/ZDI-09-079 November 4, 2009 -- Affected Vendors: Sun Microsystems -- Affected Products: Sun Microsystems Java Runtime -- TippingPointTM IPS Customer Protection: TippingPoint IPS...