Security News Aggregator!

by Black on October 19, 2010

This page will contain the latest information tit-bits from the pages we normally refer. There are a lot more, which will be added eventually. Keep reading!

Security_Focus:

Exploit_DB Updates:

Packet_Storm_Security_Exploits:

Packet_Storm_Security_Tools:

  • OpenDNSSEC 1.3.8 - OpenDNSSEC is software that manages the security of domain names on the Internet. The project intends to drive adoption of Domain Name System Security Extensions (DNSSEC) to further enhance Internet security.
  • Bluelog Bluetooth Scanner/Logger 1.0.3 - Bluelog is a Bluetooth scanner/logger written with speed in mind. It is intended to be used as a site survey tool, concerned more about accurately detecting the number of discoverable Bluetooth devices than individual device specifics. Bluelog also includes the unique "Bluelog Live" mode, which puts discovered devices into a constantly updating live webpage which you can serve up with your HTTP daemon of choice.
  • XCat 1.5 - XCat is a PHP web interface for scanning sites mined through bing.com.
  • Cura 0.4.0 - Cura is a mobile phone application bundle of remote systems administration tools. It provides a personalized terminal emulator, a syslog module that allows for reading logs directly from a server, a SysMonitor module that visually graphs CPU and RAM usage percentages, access to Nmap, and Server Stats will offer general server information like its Vitals, Hardware information, Memory information, processes, and so on. A security feature will be implemented that allows users to have Cura's database completely wiped upon them sending the compromised phone a secret pattern of their choosing (e.g. send an SMS message containing "phone has been stolen!" to your Android phone to wipe Cura's database, and receive the location of the compromised phone as an SMS to your emergency phone number or as an email to your emergency email address).
  • 360-FAAR Firewall Analysis Audit And Repair 0.2.3 - 360-FAAR Firewall Analysis Audit and Repair is an offline command line perl policy manipulation tool to filter, compare to logs, merge, translate and output firewall commands for new policies, in checkpoint dbedit or screenos commands.

Packet_Storm_Security_Advisories:

  • OpenOffice.org 3.3.0 Powerpoint Denial Of Service - A review of the code in filter/source/msfilter msdffimp.cxx in OpenOffice.org versions 3.3 and 3.4 Beta revealed some unchecked memory allocations, which could be exploited via malformed Powerpoint graphics records ("escher") to cause bad_alloc exceptions. From this vulnerability a denial of service attack is possible.
  • Drupal Zen 6.x Cross Site Scripting - Drupal Zen third party module version 6.x suffers from a cross site scripting vulnerability.
  • OpenOffice.org Memory Overwrite - OpenOffice.org versions 3.3 and 3.4 Beta suffer from a memory overwrite vulnerability.
  • Debian Security Advisory 2473-1 - Debian Linux Security Advisory 2473-1 - Tielei Wang discovered that OpenOffice.org does not allocate a large enough memory region when processing a specially crafted JPEG object, leading to a heap-based buffer overflow and potentially arbitrary code execution.
  • Drupal Aberdeen 6.x Cross Site Scripting - Drupal Aberdeen third party module version 6.x suffers from a cross site scripting vulnerability.

ZDI-Published-Advisories:

CERT Advisories:

Bugtraq:

CA Security Advisor Newly Discovered Viruses:

NVD:

  • CVE-2012-0668 (quicktime) - Buffer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with RLE encoding.
  • CVE-2012-0669 (quicktime) - Buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with Sorenson encoding.
  • CVE-2012-0667 (quicktime) - Integer signedness error in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTVR movie file.
  • CVE-2012-0265 (quicktime) - Stack-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted pathname for a file.
  • CVE-2012-0670 (quicktime) - Integer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted sean atom in a movie file.
  • CVE-2012-0666 (quicktime) - Stack-based buffer overflow in the plugin in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted QTMovie object.
  • CVE-2012-0663 (quicktime) - Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML file.
  • CVE-2012-0664 (quicktime) - Heap-based buffer overflow in Apple QuickTime before 7.7.2 on Windows allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted text track in a movie file.
  • CVE-2012-0671 (quicktime) - Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted .pict file.
  • CVE-2012-0665 (quicktime) - Heap-based buffer overflow in Apple QuickTime before 7.7.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted movie file with H.264 encoding.
  • CVE-2011-3090 (chrome) - Race condition in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to worker processes.
  • CVE-2011-3096 (chrome) - Use-after-free vulnerability in Google Chrome before 19.0.1084.46 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an error in the GTK implementation of the omnibox.
  • CVE-2011-3094 (chrome) - Google Chrome before 19.0.1084.46 does not properly handle Tibetan text, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
  • CVE-2011-3100 (chrome) - Google Chrome before 19.0.1084.46 does not properly draw dash paths, which allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors.
  • CVE-2011-3097 (chrome) - The PDF functionality in Google Chrome before 19.0.1084.46 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an out-of-bounds write error in the implementation of sampled functions.
0

Searches leading to this post:
Powered by Tradingeye 2009 Tradingeye v6 demo, 360-FAAR, 360-FAAR Firewall Analysis Audit And Repair 0 2 3, shodan cisco small business ip phones

Comments on this entry are closed.

Page 1 of 1
1