CGISecurity Logo

Topics

Tags

  • Google’s intentions are good, but implementation leave MORE users vulnerable to hacking than before

    Posted by Robert A on

    in
    , , , , , , ,
    | |

    In 2010 I wrote an article about a flaw Google discovered, and published working exploit code when no fix or mitigation existed. This allowed attackers to immediately start using the flaw to hack Google's own users (in this case, the world).  Since then Google has announced a new program 'Project Zero' which from the project…

  • Another use of Clickjacking, Cookiejacking!

    Posted by Robert A on

    in
    , , , ,
    | |

    Rosario Valotta has published an interesting attack against IE that takes advantage of clickjacking. In a nutshell it combines origin flaws within IE with clickjacking to trick a user into copying/pasting their own cookies from any site! Demonstration below The technical details can be found at https://sites.google.com/site/tentacoloviola/cookiejacking and his slides at https://docs.google.com/viewer?a=v&pid=sites&srcid=ZGVmYXVsdGRvbWFpbnx0ZW50YWNvbG92aW9sYXxneDoxMWJlZTI5ZjVhYjdiODQx  

  • How not to publish SCADA security advisories

    Posted by Robert A on

    in
    , , , ,
    | |

    "Luigi Auriemma" has posted an interesting series of SCADA vulnerabilities to the bugtraq security list this morning. From his email "The following are almost all the vulnerabilities I found for a quick experiment some months ago in certain well known server-side SCADA softwares still vulnerable in this moment. In case someone doesn't know SCADA (like…

  • Why publishing exploit code is *generally* a bad idea if you’re paid to protect

    Posted by Robert A on

    in
    , , , ,
    | |

    Update2: Further proof that people are abusing this in a wide scale and likely wouldn't have had the exploit code not been released. Update: I've clarified a few points and added a few others. Recently Tavis Ormandy (a google employee) discovered a security issue in windows, and days after notifying Microsoft published a working exploit…

  • Larry Suto Web Application Security Scanner Comparison Report Inaccurate Vendors Say

    Posted by Robert A on

    in
    , , , ,
    | |

    Larry Suto published a report comparing the various commercial web application security scanners. As you'd expect the vendors are likely to respond about how inaccurate the report is, however in this case both HP and Acunetix argued valid points. From Acunetix "They were not found because Larry didn’t authenticated our scanner (didn’t provided any credentials). No…

  • Nikto version 2.1.1 released

    Posted by Robert A on

    in
    , , , ,
    | |

    Sullo has sent the following announcement to the full disclosure mailing list indicating a new release of Nikto. "I'm happy to announce the immediate availability of Nikto 2.1.1! Nikto is an open source web server scanner which performscomprehensive tests against web servers for multiple items, includingover 6100 potentially dangerous files/CGIs, checks for outdatedversions of over…

  • Mac OS X v10.5.8 Update

    Posted by Robert A on

    in
    | |

    Apple has published the 10.5.8 Mac OS X update addressing security issues in the following products. bzip2 CFNetwork ColorSync CoreTypes Dock Image RAW ImageIO Kernel launchd Login Window MobileMe Networking XQuery Download Update: http://www.apple.com/support/downloads/Detailed Information: http://support.apple.com/kb/HT3606

  • Apple releases OS X 10.5.7 security updates

    Posted by Robert A on

    in
    , , ,
    | |

    "Apple released an update to its Leopard operating system yesterday that comes loaded with a host of security and bug fixes as well as added hardware support. The Cupertino-based firm said OS X 10.5.7 patches several security loopholes related to PHP, CoreGraphics, Apache Web server and the company’s browser Safari. Three separate vulns that could…

  • CERT Advisory VU#435052: An Architectural Flaw Involving Transparent Proxies

    Posted by Robert A on

    in
    , , , , ,
    | |

    For the past year in my spare time I've been researching a flaw involving transparent proxies and today CERT has published an advisory for this issue.  If you have a vulnerable proxy on your intranet NOW is the time to patch (details of affected vendors in the cert advisory). QBIK New Zealand SmoothWall Squid Ziproxy…

  • Microsoft Security Bulletin MS09-002

    Posted by Robert A on

    in
    , ,
    | |

    "Microsoft published four patches on Tuesday to close serious vulnerabilities in its Internet Explorer browser, Exchange e-mail server and Microsoft SQL server. The fixes, which were released on Microsoft's regular monthly schedule, close two Critical vulnerabilities in Internet Explorer 7 running on Windows XP that could allow a malicious Web site the ability to run…

  • Application Security Vendors Need Help With Reporting

    Posted by Robert A on

    in
    , , , , , , , ,
    | |

    I've been reading web application vulnerability reports from tools and services for 6-7 years and found that 99% of these reports are geared towards security engineers or system administrators. Many of the reports I see focus on The type of flaw and what it its impact is The URL affected Links to references and additional…

  • Web Application Scanners Comparison

    Posted by Robert A on

    in
    , , , ,
    | |

    anantasec posted a scanner comparison to the web security mailing list today. "In the past weeks, I've performed an evaluation/comparison of three popular web vulnerability scanners.This evaluation was ordered by apenetration testing company that will remain anonymous. The vendorswere not contacted during or after the evaluation. The applications (web scanners) included in this evaluation are:–…

  • Microsoft Patch Tuesday: MS09-001

    Posted by Robert A on

    in
    , ,
    | |

    Microsoft has just published MS09-001 . This update addresses an SMB flaw. "Vulnerabilities in SMB Could Allow Remote Code Execution (958687) This security update resolves several privately reported vulnerabilities in Microsoft Server Message Block (SMB) Protocol. The vulnerabilities could allow remote code execution on affected systems. An attacker who successfully exploited these vulnerabilities could install…

  • Fixing Both Missing HTTPOnly and Secure Cookie Flags with modsecurity

    Posted by Robert A on

    in
    ,
    | |

    Ryan Barnett has posted an entry on identifying sessions lacking HTTPOnly and secure cookie flags on modsecurity. "In a previous post I showed how you can use both ModSecurity and Apache together to identify/modify SessionIDs that are missing the HTTPOnly flag.  I received some feedback where people were asking how to accomplish the same thing but…

  • Internet Explorer 8.0 Beta 2 Anti-XSS Filter Vulnerabilities

    Posted by Robert A on

    in
    , , , ,
    | |

    Rafel Ivgi has published an extensive list of IE8 XSS filter evasions. "Aspect9 has discovered several vulnerabilities in Microsoft Windows Internet Explorer 8.0 Beta 2. This new version of Microsoft's famous browser includes new security improvements such as a Cross Site Scripting(XSS) filter. This version also includes a new object that safely allows transferring data…

  • Microsoft to offer free Antivirus

    Posted by Robert A on

    in
    , ,
    | |

    "Microsoft on Tuesday said it plans to kill off its Windows Live OneCare subscription security service in favor of a free offering that will feature a core of essential anti-malware tools while excluding peripheral services, such as PC tune up programs, found in OneCare. The move could help the software maker extend its footprint in…

  • Understanding How to Use the Microsoft’s Exploitability Index

    Posted by Robert A on

    in
    , ,
    | |

    "On Oct. 14, 2008, Microsoft added another piece of information to the bulletin summary to better help customers with their risk assessment process: the Exploitability Index. This section is a brief overview to explain how customers can integrate the Exploitability Index with the Severity Rating system into their own risk assessment process. The Exploitability Index…

  • MS explains 7-year patch delay

    Posted by Robert A on

    in
    ,
    | |

    "Microsoft has explained why it took seven years to patch a known vulnerability. Fixing the bug earlier would have taken out network applications and potential exploits alike, it explained. Security bulletin MS08-068 fixed a flaw in the SMB (Server Message Block) component of Windows, first demonstrated by Sir Dystic of Cult of the Dead Cow…

  • Microsoft’s Stance on Banned APIs

    Posted by Robert A on

    in
    ,
    | |

    Microsoft has a blog entry on their mentality/process on banning certain API calls to improve their software’s security. "Jeremy Dallman here with a quick note about a code sanitizing tool we are making available to support one of the SDL requirements – Remove all Banned APIs from your code. This requirement was put in place…

  • OWASP European Summit 2008 is November 3-7 in Portugal

    Posted by Robert A on

    in
    ,
    | |

    Matthew Chalmers submitted the following news. "With the theme "Setting the AppSec Agenda for 2009" the OWASP Summit will be a worldwide gathering of OWASP leaders and key industry players to present and discuss the latest OWASP tools, documentation projects, and web application security trends. Join us in Portugal in just a few short weeks!…

  • Apache Debates the Apache UTF-7 XSS

    Posted by Robert A on

    in
    , ,
    | |

    There is a great debate on the bugtraq mailing list regarding the apache utf7 xss issue. In this debate William Rowe (Apache) discusses why the Apache utf7 vulnerability is in fact not a vulnerability in Apache but in Internet Explorer for not following specifications properly. William first posted to bugtraq http://seclists.org/bugtraq/2008/May/0166.html with the following "Internet…

  • Google bots now submit forms in effort to find new pages

    Posted by Robert A on

    in
    , , ,
    | |

    "Google's search bots, which scour the web constantly for new pages, have begun a new, more active phase of their indexing jobs. In a blog post last week, Jayant Madhavan and Alon Halevy of Google's crawling and indexing team said the company has begun an experiment in which its indexing software experimentally enters text in…

  • Microsoft admits it knew about, didn’t patch, bugs

    Posted by Robert A on

    in
    , ,
    | |

    "Microsoft Corp.'s security team today acknowledged that it knew of bugs in its Jet Database Engine as far bask as 2005 but did not patch the problems because it thought it had blocked the obvious attack vectors. A researcher at Symantec Corp. said Microsoft should have fixed the flaws years ago. In a post to…

  • How microsoft.com works

    Posted by Robert A on

    in
    | |

    "If you've ever wondered how microsoft.com uses our technology then read on. I recently came across some good information from the folks over at the Operations team at Microsoft.com. The thread basically talks about how we use IIS, Firewalls and Windows Server 2008. I think as we come up to launch next year it's a…

  • Google Fixes Gmail Cross-site Request Forgery Vulnerability

    Posted by Robert A on

    in
    , , ,
    | |

    "Google has fixed a vulnerability in their Gmail web based email service which would have allowed internet attackers to steal mail messages from users without being noticed. The attack works by forcing a logged-in user to add a mail filter to their Gmail account, thereby allowing their mail to be forwarded to an external mail…

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.