Computer Security Vulnerabilities

security | 2 Jul 2012 16:59

[ MDVSA-2012:096-1 ] python


 _______________________________________________________________________

 Mandriva Linux Security Advisory                       MDVSA-2012:096-1
 http://www.mandriva.com/security/
 _______________________________________________________________________

 Package : python
 Date    : July 2, 2012
 Affected: Enterprise Server 5.0
 _______________________________________________________________________

 Problem Description:

 Multiple vulnerabilities has been discovered and corrected in python:

 The _ssl module would always disable the CBC IV attack countermeasure
 (CVE-2011-3389).

 A flaw was found in the way the Python SimpleHTTPServer module
 generated directory listings. An attacker able to upload a file
 with a specially-crafted name to a server could possibly perform a
 cross-site scripting (XSS) attack against victims visiting a listing
 page generated by SimpleHTTPServer, for a directory containing
 the crafted file (if the victims were using certain web browsers)
 (CVE-2011-4940).

 A race condition was found in the way the Python distutils module
 set file permissions during the creation of the .pypirc file. If a
 local user had access to the home directory of another user who is

(Continue reading)

security-alert | 2 Jul 2012 17:39

Picon

[security bulletin] HPSBMU02781 SSRT100617 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows running PostgreSQL, Remote Execution of Arbitrary Code, Denial of Service (DoS)


Note: the current version of the following document is available here:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03333585

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03333585
Version: 1

HPSBMU02781 SSRT100617 rev.1 - HP Network Node Manager i (NNMi) for HP-UX,
Linux, Solaris, and Windows running PostgreSQL, Remote Execution of Arbitrary
Code, Denial of Service (DoS)

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2012-07-02
Last Updated: 2012-07-02

Potential Security Impact: Remote execution of arbitrary code, Denial of
Service (DoS)

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP Network Node
Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows running PostgreSQL.
The vulnerabilities could be remotely exploited resulting in execution of
arbitrary code and Denial of Service (DoS) .

(Continue reading)

security-alert | 2 Jul 2012 17:39

Picon

[security bulletin] HPSBMU02783 SSRT100806 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows, Remote Cross Site Scripting (XSS)


Note: the current version of the following document is available here:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03343724

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03343724
Version: 1

HPSBMU02783 SSRT100806 rev.1 - HP Network Node Manager i (NNMi) for HP-UX,
Linux, Solaris, and Windows, Remote Cross Site Scripting (XSS)

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2012-07-02
Last Updated: 2012-07-02

Potential Security Impact: Remote cross site scripting (XSS)

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY
Potential security vulnerabilities have been identified with HP Network Node
Manager I (NNMi) for HP-UX, Linux, Solaris, and Windows. The vulnerabilities
could be remotely exploited resulting in cross site scripting (XSS).

References: CVE-2012-2018

(Continue reading)

Research@NGSSecure | 2 Jul 2012 18:42

NGS00196 Patch Notification: Nagios XI Network Monitor OS Command Injection

High Risk Vulnerability in Nagios XI Network Monitor 

2 July 2012

Daniel Compton of NCC Group has discovered a High risk vulnerability in Nagios XI Network Monitor

Impact: Nagios XI Network Monitor OS Command Injection

Versions affected:
Nagios XI Network Monitor 2011R1.9

An updated version of the software has been released to address these vulnerabilities:
Resolved in SVN 1.3 of Graph Explorer - http://exchange.nagios.org/directory/Addons/Components/Graph-Explorer-Component/details

NCC Group is going to withhold details of these flaws for three months. This three month window will allow
users the time needed to apply the patch before the details are released to the general public. This
reflects the NCC Group approach to responsible disclosure.

NCC Group Research
http://www.nccgroup.com

Research@NGSSecure | 2 Jul 2012 18:44

NGS00194 Patch Notification: Nagios XI Network Monitor Blind SQL Injection

High Risk Vulnerability in Nagios XI Network Monitor 

2 July 2012

Daniel Compton of NCC Group has discovered a High risk vulnerability in Nagios XI Network Monitor

Impact: Nagios XI Network Monitor Blind SQL Injection

Versions affected:
Nagios XI Network Monitor 2011R1.9

An updated version of the software has been released to address these vulnerabilities:
http://labs.nagios.com/2012/04/13/nagios-xi-ccm-full-beta/

NCC Group is going to withhold details of these flaws for three months. This three month window will allow
users the time needed to apply the patch before the details are released to the general public. This
reflects the NCC Group approach to responsible disclosure.

NCC Group Research
http://www.nccgroup.com

Research@NGSSecure | 2 Jul 2012 18:46

NGS00195 Patch Notification: Nagios XI Network Monitor Stored and Reflected XSS

High Risk Vulnerability in Nagios XI Network Monitor 

2 July 2012

Daniel Compton of NCC Group has discovered a High risk vulnerability in Nagios XI Network Monitor

Impact: Nagios XI Network Monitor Stored and Reflected XSS

Versions affected:
Nagios XI Network Monitor 2011R1.9

An updated version of the software has been released to address these vulnerabilities:
http://tracker.nagios.org/view.php?id=284

Fixed in release XI 2011r3.0

http://assets.nagios.com/downloads/nagiosxi/CHANGES-2011.TXT

NCC Group is going to withhold details of these flaws for three months. This three month window will allow
users the time needed to apply the patch before the details are released to the general public. This
reflects the NCC Group approach to responsible disclosure.

NCC Group Research
http://www.nccgroup.com

Research@NGSSecure | 2 Jul 2012 19:18

NGS00162 Patch Notification: Symantec Message Filter Session Hijacking via session fixation

High Risk Vulnerability in Symantec Message Filter 

2 July 2012

Ben Williams of NCC Group has discovered a High risk vulnerability in Symantec Message Filter

Impact: Session Hijacking via session fixation

Versions affected:
Symantec Message Filter Version 6.3

An updated version of the software has been released to address these vulnerabilities:

http://www.symantec.com/business/support/index?page=content&id=TECH191487

NCC Group is going to withhold details of this flaw for three months. This three month window will allow
users the time needed to apply the patch before the details are released to the general public. This
reflects the NCC Group approach to responsible disclosure.

NCC Group Research
http://www.nccgroup.com

Adam Behnke | 2 Jul 2012 21:17

Malicious Code Execution in PCI Expansion ROM

The malicious code in x86/x64 firmware can potentially reside in many
places. One of them is in the PCI expansion ROM. In the past, the small
amount of memory during PCI expansion ROM execution acted as a hindrance to
malicious code. The limited space for code and data limited the possible
tasks that could be carried out by such malicious codes. However, this
article explains how a malicious PCI expansion ROM might exploit a
little-known BIOS memory management interface to break through the memory
"barrier," thus creating a potentially more complex threat. The discussion
in this article is limited to PCI expansion ROM conforming to PCI firmware
revision 3.1 specification.

This newly "discovered" larger memory footprint enables a malware creator to
place (at least) a simple file system infector inside the PCI expansion ROM
(a compressed one). During PCI expansion ROM execution, the compressed file
system infector could have the memory it requires through memory allocation
with the PMM functions, provided that the BIOS implemented PMM-which is most
likely the case in the last 3 to 5 years. Another issue is that a malware
creator might abuse the presence of the "permanent" memory allocated for PCI
expansion ROM through the pmmAllocate() function by using the permanent
memory flag during the call to pmmAllocate().Additionally, a rogue but
simple network "interceptor" code might be possible given the jump in the
memory footprint, and if the interceptor hides in the "permanent" memory, it
could be troublesome.

View here: http://resources.infosecinstitute.com/pci-expansion-rom/ to read
the full article and walkthrough at InfoSec Institute.

Yves-Alexis Perez | 2 Jul 2012 22:31

Picon

[SECURITY] [DSA 2506-1] libapache-mod-security security update


-------------------------------------------------------------------------
Debian Security Advisory DSA-2506-1                   security <at> debian.org
http://www.debian.org/security/                         Yves-Alexis Perez
July 02, 2012                          http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package        : libapache-mod-security
Vulnerability  : modsecurity bypass
Problem type   : remote
Debian-specific: no
CVE ID         : CVE-2012-2751
Debian Bug     : #678529

Qualys Vulnerability & Malware Research Labs discovered a vulnerability in
ModSecurity, a security module for the Apache webserver. In situations where
both 'Content:Disposition: attachment' and 'Content-Type: multipart' were
present in HTTP headers, the vulernability could allow an attacker to bypass
policy and execute cross-site script (XSS) attacks through properly crafted
HTML documents.

For the stable distribution (squeeze), this problem has been fixed in
version 2.5.12-1+squeeze1.

For the testing distribution (wheezy), this problem has been fixed in
version 2.6.6-1.

For the unstable distribution (sid), this problem has been fixed in
version 2.6.6-1.

(Continue reading)

security-alert | 3 Jul 2012 06:16

Picon

[security bulletin] HPSBUX02795 SSRT100878 rev.1 - HP-UX Running BIND, Remote Denial of Service (DoS)


Note: the current version of the following document is available here:
https://h20566.www2.hp.com/portal/site/hpsc/public/kb/
docDisplay?docId=emr_na-c03388901

SUPPORT COMMUNICATION - SECURITY BULLETIN

Document ID: c03388901
Version: 1

HPSBUX02795 SSRT100878 rev.1 - HP-UX Running BIND, Remote Denial of Service
(DoS)

NOTICE: The information in this Security Bulletin should be acted upon as
soon as possible.

Release Date: 2012-07-02
Last Updated: 2012-06-29

Potential Security Impact: Remote Denial of Service (DoS)

Source: Hewlett-Packard Company, HP Software Security Response Team

VULNERABILITY SUMMARY
A potential security vulnerability has been identified with HP-UX running
BIND. This vulnerability could be exploited remotely to create a Denial of
Service (DoS).

References: CVE-2012-1667

(Continue reading)

Group

gmane.comp.security.bugtraq.

Search Archive

Page

1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 14

Articles in period: 131

July 2012

Language

Change language

Options

Current view: Threads only / Showing only 20 lines / Not hiding cited text.
Change to All messages, whole messages, or hide cited text.

Post a message
NNTP Newsgroup
Classic Gmane web interface
XML

XML

RSS Feed
List Information

About Gmane

Recent entries

[waraxe-2013-SA#104] - Multiple Vulnerabilities in Spider Event Calend (22 May 2013)
Trend Micro DirectPass 1.5.0.1060 - Multiple Vulnerabilities (22 May 2013)
VUPEN Security Research - Microsoft Internet Explorer 10-9 Object Conf (21 May 2013)
VUPEN Security Research - Microsoft Internet Explorer 10-9-8-7-6 VML R (21 May 2013)
[ MDVSA-2013:166 ] krb5 (21 May 2013)
Sony PS3 Firmware v4.31 - Code Execution Vulnerability (21 May 2013)
CVE-2013-3496. Local privilege escalation vulnerability in Infotecs pr (20 May 2013)
Static analysis tool exposition (SATE) V Call for participation (17 May 2013)
CONFidence - May, 28-29, Krakow, Poland - a conference adventure that (17 May 2013)
APPLE-SA-2013-05-16-1 iTunes 11.0.3 (16 May 2013)
ESA-2013-029: RSA SecurID Sensitive Information Disclosure Vulnerabili (16 May 2013)
ESA-2013-041: EMC VNX and Celerra Control Station Elevation of Privile (16 May 2013)
[SECURITY] [DSA 2669-1] linux security update (16 May 2013)
Cisco Security Advisory: Cisco TelePresence Supervisor MSE 8050 Denial (15 May 2013)
Multiple Vulnerabilities in Exponent CMS (15 May 2013)
[ MDVSA-2013:165 ] firefox (15 May 2013)
[security bulletin] HPSBUX02859 SSRT101144 rev.3 - HP-UX Running XNTP, (15 May 2013)
[SECURITY] [DSA 2668-1] linux-2.6 security update (14 May 2013)
File Lite 3.3 & 3.5 PRO iOS - Multiple Web Vulnerabilities (12 May 2013)
SimpleTransfer 2.2.1 - Command Injection Vulnerabilities (12 May 2013)
Wireless Photo Access 1.0.10 iOS - Multiple Vulnerabilities (12 May 2013)

Archives

63	May 2013
230	April 2013
130	March 2013
135	February 2013
97	January 2013
104	December 2012
97	November 2012
125	October 2012
105	September 2012
147	August 2012
131	July 2012
129	June 2012
128	May 2012
188	April 2012
161	March 2012
134	February 2012
136	January 2012
155	December 2011
155	November 2011
151	October 2011
160	September 2011
159	August 2011
157	July 2011
117	June 2011
152	May 2011
212	April 2011
250	March 2011
158	February 2011
145	January 2011
216	December 2010
171	November 2010
221	October 2010
161	September 2010
269	August 2010
223	July 2010
178	June 2010
254	May 2010
186	April 2010
186	March 2010
160	February 2010
209	January 2010
256	December 2009
146	November 2009
261	October 2009
249	September 2009
271	August 2009
279	July 2009
284	June 2009
325	May 2009
316	April 2009
295	March 2009
255	February 2009
320	January 2009
273	December 2008
254	November 2008
284	October 2008
362	September 2008
323	August 2008
317	July 2008
249	June 2008
379	May 2008
344	April 2008
425	March 2008
477	February 2008
452	January 2008
385	December 2007
473	November 2007
491	October 2007
435	September 2007
517	August 2007
410	July 2007
412	June 2007
451	May 2007
511	April 2007
510	March 2007
579	February 2007
685	January 2007
464	December 2006
611	November 2006
568	October 2006
564	September 2006
606	August 2006
610	July 2006
796	June 2006
725	May 2006
628	April 2006
659	March 2006
602	February 2006
613	January 2006
415	December 2005
430	November 2005
441	October 2005
441	September 2005
473	August 2005
595	July 2005
366	June 2005
394	May 2005
568	April 2005
595	March 2005
567	February 2005
426	January 2005
536	December 2004
489	November 2004
396	October 2004
480	September 2004
439	August 2004
406	July 2004
527	June 2004
369	May 2004
456	April 2004
441	March 2004
730	February 2004
470	January 2004
372	December 2003
448	November 2003
460	October 2003
679	September 2003
477	August 2003
487	July 2003
282	June 2003
394	May 2003
425	April 2003
510	March 2003
411	February 2003
445	January 2003
287	December 2002
427	November 2002
453	October 2002
366	September 2002
407	August 2002
450	July 2002
379	June 2002
298	May 2002
426	April 2002
292	March 2002
1	December 2001
2	July 2001
1	July 2000
2	January 2000

Design

Zawodny | Right Menu | Left Menu

Your Own Design

Paste the URL of your CSS below. Download CSS template