infosec daily: news

Home

Security Blogs

Security Community Twitter

RSS

About

Last updated: Sat Jul 4 01:11:30 2009 GMT

2008 FIRST Annual Conference in Japan - Register now

Recent bugs

via SecurityFocus,

•	Drupal Cross-Site Scripting, Code Injection and Information Disclosure Vulnerabilities

•	phpMyAdmin SQL bookmark HTML Injection Vulnerability

•	Irssi 'WALLOPS' Message Off By One Heap Memory Corruption Vulnerability

•	OpenSSL 'dtls1_retrieve_buffered_fragment()' DTLS Packet Denial of Service Vulnerability

•	Pidgin OSCAR Protocol Web Message Denial of Service Vulnerability

•	Nagios 'statuswml.cgi' Remote Arbitrary Shell Command Injection Vulnerability

•	Ruby 'OCSP_basic_verify()' X.509 Certificate Verification Vulnerability

•	APOP Protocol Insecure MD5 Hash Weakness

•	'Compress::Raw::Zlib' Perl Module Remote Code Execution Vulnerability

•	VLC Media Player 'smb://' URI Handling Remote Buffer Overflow Vulnerability

Recent advisories

via Secunia, US-CERT,

•	TA09-160A: Microsoft Updates for Multiple Vulnerabilities

•	TA09-161A: Adobe Acrobat and Reader Vulnerabilities

•	TA09-133A: Apple Updates for Multiple Vulnerabilities

•	TA09-133B: Adobe Reader and Acrobat JavaScript Vulnerabilities

•	TA09-132A: Microsoft PowerPoint Multiple Vulnerabilities

•	TA09-105A: Oracle Updates for Multiple Vulnerabilities

•	TA09-104A: Microsoft Updates for Multiple Vulnerabilities

•	TA09-088A: Conficker Worm Targets Microsoft Windows Systems

•	TA09-069A: Microsoft Updates for Multiple Vulnerabilities

•	TA09-051A: Adobe Acrobat and Reader Vulnerability

•	[1/5] Gentoo update for valgrind

•	[2/5] Sun Solaris / SEAM Kerberos PAM Module Privilege Escalation

•	[2/5] Sun Java System Directory Server Directory Proxy Server Denial of Service

•	[3/5] Swann DVR4-SecuraNet Directory Traversal Vulnerability

•	[3/5] Free Joke Script Multiple SQL Injection Vulnerabilities

•	[3/5] PHP Krazy Image Host Script "id" SQL Injection Vulnerability

•	[2/5] UniversalIndentGUI "SettingsPaths::init()" Insecure Temporary Files

•	[2/5] Fedora update for python-fedora

•	[3/5] Fedora update for squid

•	[1/5] Fedora update for asterisk and dahdi-tools

Bugtraq Topics

via SecurityFocus,

•	Re: Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome

•	Cross-Site Scripting vulnerabilities in Mozilla, Internet Explorer, Opera and Chrome

•	One Click Ownage [White Paper and Scripts]

•	[oCERT-2009-007] FCKeditor input sanitization errors

•	[SECURITY] [DSA 1825-1] New nagios2/nagios3 packages fix arbitrary code execution

•	[USN-795-1] Nagios vulnerability

•	[ GLSA 200907-01 ] libwmf: User-assisted execution of arbitrary code

•	[ GLSA 200907-02 ] ModSecurity: Denial of Service

•	Multiple Flaws in Axesstel MV 410R

•	[ISecAuditors Security Advisories] Joomla! < 1.5.12 Multiple XSS vulnerabilities in HTTP Headers

Top Worms and Viruses

via Sophos,

•	Troj/Invo-Zip

•	W32/Netsky

•	Mal/EncPk-EI

•	Troj/Pushdo-Gen

•	Troj/Agent-HFU

•	Mal/Iframe-E

•	Troj/Mdrop-BTV

•	Troj/Mdrop-BUF

•	Troj/Agent-HFZ

•	Troj/Agent-HGT

Latest MS bulletins

via Microsoft,

•	MS09-027 - Critical: Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (969514)

•	MS09-026 - Important: Vulnerability in RPC Could Allow Elevation of Privilege (970238)

•	MS09-025 - Important: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (968537)

•	MS09-024 - Critical: Vulnerability in Microsoft Works Converters Could Allow Remote Code Execution (957632)

•	MS09-023 - Moderate: Vulnerability in Windows Search Could Allow Information Disclosure (963093)

•	MS09-022 - Critical: Vulnerabilities in Windows Print Spooler Could Allow Remote Code Execution (961501)

•	MS09-021 - Critical: Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (969462)

•	MS09-020 - Important: Vulnerabilities in Internet Information Services (IIS) Could Allow Elevation of Privilege (970483)

•	MS09-019 - Critical: Cumulative Security Update for Internet Explorer (969897)

•	MS09-018 - Critical: Vulnerabilities in Active Directory Could Allow Remote Code Execution (971055)

Stock Watch

via Yahoo! Finance

Updated 3/1/2008

TMICY.PK	34.25	+0.10
TMWD	1.28	-0.02
NASDAQ	2271.48	-60.09
AMD	7.21	+0.19
BCSI	23.48	-0.50
CA	22.88	-0.24
CIC.TO	1.48	-0.09
CKP	24.20	-0.48
CSCO	24.39	-0.27
CWDW.OB	0.0034	-0.0006
FIRE	6.00	-0.34
IBM	113.86	-1.38
INTC	19.9699	-0.5201
INTZ.OB	0.15	+0.01
JNPR	26.82	-1.77
MFE	33.27	-0.98
MSFT	27.1999	-0.7301
PKTR	4.47	-0.12
SCLD	0.89	+0.0201
SNWL	8.33	-0.18
SYMC	16.84	-0.45
VRSN	34.80	-1.20
WBSN	19.47	-0.02

When AV attacks

IT admins across the globe are letting out a collective groan after servers and PCs running McAfee VirusScan attacked core system files, in some cases causing the machines to display the dreaded blue screen of death.

News: iPhone crashing bug could lead to serious exploit
SecurityFocus News
iPhone crashing bug could lead to serious exploit

>> Advertisement <<
Can you answer the ERP quiz?
These 10 questions determine if your Enterprise RP rollout gets an A+.
Well-honed Attacks Sneak Under the Radar
Computerworld Security News
None

Brief: Researcher aims to tweet Month of Bugs
SecurityFocus News
Researcher aims to tweet Month of Bugs

Kentucky payroll phishing scam nets small fortune
The Register - Security: Anti-Virus

Blue grass county hit by Trojan-fueled cybercrime

A gang of cybercrooks has made off with $415,000 from the coffers of Bullitt County, Kentucky following the conclusion of an elaborate phishing scam, The Washington Post reports.

Authorize.net down, (Fri, Jul 3rd)
SANS Internet Storm Center, InfoCON: green
The credit card payment gateway authorize.net is currently down ...(more)...

FCKEditor advisory, (Fri, Jul 3rd)
SANS Internet Storm Center, InfoCON: green
FCKeditor, a web based open source HTML text editor, suffers from a remote file upload vulnera ...(more)...

BCP/DRP, (Fri, Jul 3rd)
SANS Internet Storm Center, InfoCON: green
Question, what do Bing.com and Authorize ...(more)...

Happy 4th of July!, (Fri, Jul 3rd)
SANS Internet Storm Center, InfoCON: green
Celebrate, watch fireworks, but don't click on links in emails or surf to sites with Fourth of July, ...(more)...

RSA's Coviello: Cloud computing not secure enough
Network World on Security
Cloud-based services are being rolled out without enough attention being paid to securing these services and the information they handle. That was the finding of a recent study commissioned by RSA Security.

Suit over China's Web filter to target Lenovo, Acer, Sony
Network World on Security
A U.S. company will seek legal action against Lenovo, Acer and Sony next week over their shipment in China of controversial software that the company says stole its programming code.

Solaris: access to vntsd
Vigil@nce - public vulnerabilities
A local attacker can connect to vntsd in order to access to the console of a guest virtual system.

VUPEN - Drupal Multiple Cross Site Scripting and Security Bypass Vulnerabilities
VUPEN Security Advisories
Multiple vulnerabilities have been identified in Drupal, which could be exploited by attackers to disclose sensitive information or bypass security restrictions...

VUPEN - Drupal Advanced Forum Cross Site Scripting and Security Bypass Issues
VUPEN Security Advisories
Multiple vulnerabilities have been identified in Advanced Forum (module for Drupal), which could be exploited by attackers to disclose sensitive information or bypass security restrictions...

VUPEN - wxWidgets "wxImage::Create()" Function Integer Overflow Vulnerability
VUPEN Security Advisories
A vulnerability has been identified in wxWidgets, which could be exploited by attackers to compromise a vulnerable system...

VUPEN - Sun Solaris SNMP GETBULK Request Denial of Service Vulnerability
VUPEN Security Advisories
A vulnerability has been identified in Sun Solaris, which could be exploited by remote attackers to cause a denial of service...

VUPEN - Sun Lightweight Availability Collection Tool File Overwrite Vulnerability
VUPEN Security Advisories
A vulnerability has been identified in Sun Lightweight Availability Collection Tool, which could be exploited by local attackers to cause a denial of service...

VUPEN - Apache "mod_proxy" Reverse proxy Denial of Service Vulnerability
VUPEN Security Advisories
A vulnerability has been identified in Apache, which could be exploited by remote attackers to cause a denial of service...

VUPEN - IBM Tivoli Identity Manager Two Cross Site Scripting Vulnerabilities
VUPEN Security Advisories
Two vulnerabilities have been identified in IBM Tivoli Identity Manager, which could be exploited to conduct cross site scripting attacks...

Fedora 10 2009-3651: xorg-x11-xfs
Nessus.org Plugins
Synopsis :

The remote host is missing the patch for the advisory FEDORA-2009-3651 (xorg-x11-xfs)

Description :

X.Org X11 xfs font server

-
ChangeLog:

Update information :

Fedora 9 2009-3666: xorg-x11-xfs
Nessus.org Plugins
Synopsis :

The remote host is missing the patch for the advisory FEDORA-2009-3666 (xorg-x11-xfs)

Description :

X.Org X11 xfs font server

-
ChangeLog:

Update information :

FreeBSD : nfsen -- remote command execution (5143)
Nessus.org Plugins
Synopsis :

The remote host is missing a security update

Description :

The following package needs to be updated: nfsen

See also :

[GLSA-200907-01] libwmf: User-assisted execution of arbitrary code
Nessus.org Plugins
Synopsis :

The remote host is missing the GLSA-200907-01 security update.

Description :

The remote host is affected by the vulnerability described in GLSA-200907-01
(libwmf: User-assisted execution of arbitrary

[GLSA-200907-02] ModSecurity: Denial of Service
Nessus.org Plugins
Synopsis :

The remote host is missing the GLSA-200907-02 security update.

Description :

The remote host is affected by the vulnerability described in GLSA-200907-02
(ModSecurity: Denial of Service)

RHSA-2009-1138: openswan
Nessus.org Plugins
Synopsis :

The remote host is missing the patch for the advisory RHSA-2009-1138

Description :

Updated openswan packages that fix multiple security issues are now
available for Red Hat Enterprise Linux 5.

RHSA-2009-1139: finch
Nessus.org Plugins
Synopsis :

The remote host is missing the patch for the advisory RHSA-2009-1139

Description :

Updated pidgin packages that fix one security issue and one bug are now
available for Red Hat Enterprise Linux 4 a

RHSA-2009-1140: ruby
Nessus.org Plugins
Synopsis :

The remote host is missing the patch for the advisory RHSA-2009-1140

Description :

Updated ruby packages that fix multiple security issues are now available
for Red Hat Enterprise Linux 4 and 5.

USN794-1 : libcompress-raw-zlib-perl, perl vulnerability
Nessus.org Plugins
Synopsis :

These remote packages are missing security patches :
- libcgi-fast-perl
- libcompress-raw-zlib-perl
- libperl-dev
- libperl5.10
- perl
- perl-base
- perl-debug
- perl-doc

USN795-1 : nagios2, nagios3 vulnerability
Nessus.org Plugins
Synopsis :

These remote packages are missing security patches :
- nagios2
- nagios2-common
- nagios2-dbg
- nagios2-doc
- nagios3
- nagios3-common
- nagios3-dbg
- nagios3-doc

Malware authors hit by recession too
Techworld.com Security News
Even crims feeling pinch says security company.

The recession might be having at least one positive effect - it has started cutting the volume of malware.

Commercile spamfilters beter dan opensource
Security.NL nieuws
Commercile spamfilters presteren veel beter dan opensource alternatieven zoals SpamAssassin en ClamAV, zo blijkt uit onderzoek van VirusBulletin, dat naast virusscanners ook spamfilters test.

iPhone niet te hacken via SMS-bericht
Security.NL nieuws
Berichten in de media gisteren dat Apple iPhones via het sturen van een SMS-bericht zijn te hacken, zijn onjuist, aldus de onderzoeker die het beveiligingsprobleem ontdekte.

Apple iPhone 3GS Jailbreaking Tool Hits the Street
Security - RSS Feeds
The hacker who made the news in 2007 for unlocking Apple's first iPhone has released the a new application for jailbreaking the iPhone 3GS. The tool is currently available for Windows only.
- George Hotz, the 19-year old hacker who made headlines

Symantec's Ramzan on solving the antivirus puzzle
CNET News.com - Security
q&a; From puzzles and chess to ciphers and antivirus software, Zulfikar Ramzan talks about how he got into the computer security business and where it's headed.

Ubuntu Security Notice - libcompress-raw-zlib-perl, perl vulnerability (USN-794-1)
Help Net Security - Advisories
=========================================================== Ubuntu Security Notice USN-794-1 July 02, 2009 libcompress-raw-zlib-perl, perl vulnerability CVE-2009-1391 ================...

Ubuntu Security Notice - nagios2, nagios3 vulnerability (USN-795-1)
Help Net Security - Advisories
=========================================================== Ubuntu Security Notice USN-795-1 July 02, 2009 nagios2, nagios3 vulnerability CVE-2009-2288 ===============================...

Gentoo Linux Security Advisory - libwmf: User-assisted execution of arbitrary code (GLSA 200907-01)
Help Net Security - Advisories
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200907-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - ...

Gentoo Linux Security Advisory - ModSecurity: Denial of Service (GLSA 200907-02)
Help Net Security - Advisories
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 200907-02 - - - - - - - - - - - - - - - - - - - - - - - - - - - ...

SUSE Security Announcement - java-1_6_0-ibm (SUSE-SA:2009:036)
Help Net Security - Advisories
______________________________________________________________________________ SUSE Security Announcement Package: java-1_6_0-ibm Announce...

Solaris: bypassing nfs_portmon
Vigil@nce - public vulnerabilities
A NFSv4 client can bypass the nfs_portmon directive in order to connect to the server.

VUPEN - MP3-Nator Playlist File Processing Buffer Overflow Vulnerability
VUPEN Security Advisories
A vulnerability has been identified in MP3-Nator, which could be exploited by attackers to compromise a vulnerable system...

VUPEN - KerviNet Forum SQL Injection and Cross Site Scripting Vulnerabilities
VUPEN Security Advisories
Multiple vulnerabilities have been identified in KerviNet Forum, which could be exploited by attackers to manipulate or disclose certain data...

VUPEN - CMS Chainuk Multiple Code Injection and File Inclusion Vulnerabilities
VUPEN Security Advisories
Multiple vulnerabilities have been identified in CMS Chainuk, which could be exploited by attackers to manipulate or disclose certain data, or compromise a vulnerable web server...

Related-key Cryptanalysis of Full AES-192 and AES-256
Virus.Org - Computer Security news for the IT Security Professional.
New research develops an attack against AES-256 that is better than brute force.