CGISecurity Logo

Topics

Tags

  • Anti DNS Pinning/DNS Rebinding is the new industry buzz(word)

    Posted by Robert A on

    in
    ,
    | |

    Anti-DNS Pinning/DNS Rebinding is the new security hot topic lately and I wouldn't expect the marketingfest to end anytime soon. "While previous attacks using JavaScript could send data to a network, the attack investigated by Stanford — known as domain-name service (DNS) rebinding — could send and receive data from the local network, completely bypassing…

  • Avoid the dangers of XPath injection

    Posted by Robert A on

    in
    ,
    | |

    "As new technologies emerge and become well established so do threats against those technologies. Blind SQL injection attacks are a well know and recognized form of code injection attack, but there are many other forms, some not so well documented or understood. An emerging code injection attack is the XPath injection attack, which takes advantage…

  • Mozilla Protocol Abuse

    Posted by Robert A on

    in
    ,
    | |

    Larholm writes "First they came for Safari, but no one complained because it was beta. Then they came for Internet Explorer, but no one cared because that was to be expected. Finally they came for Mozilla, but there was no one left to speak out." Article Link: http://larholm.com/2007/07/25/mozilla-protocol-abuse/

  • Mozilla confirms own URL handling bug

    Posted by Robert A on

    in
    ,
    | |

    "The Mozilla Foundation acknowledged over the weekend that its own Firefox browser allows links that can send malicious code to external programs, a security issue that the group had previously argued should be fixed by the browser maker. In early July, three researchers found a way to execute code in Firefox – and potentially other…

  • Zero-day sales not “fair” — to researchers

    Posted by Robert A on

    in
    ,
    | |

    " Two years ago, Charles Miller found a remotely exploitable flaw in a common component of the Linux operating system, and as many enterprising vulnerability researchers are doing today, he decided to sell the information. “ I don't think it fair that researchers don't have the information and contacts they need to sell their research.…

  • Dangerous Java flaw threatens virtually everything

    Posted by Robert A on

    in
    ,
    | |

    "Google's Security team has discovered vulnerabilities in the Sun Java Runtime Environment that threatens the security of all platforms, browsers and even mobile devices. "This is as bad as it gets," said Chris Gatford, a security expert from penetration testing firm Pure Hacking. "It’s a pretty significant weakness, which will have a considerable impact if…

  • Average zero-day bug has 348-day lifespan, exec says

    Posted by Robert A on

    in
    , ,
    | |

    "The average zero-day (0day) bug has a lifespan of 348 days before it is discovered or patched, and some vulnerabilities live on for much longer, according to security vendor Immunity Inc.'s chief executive officer. Zero-day bugs are vulnerabilities that have not been patched or made public. When discovered and not disclosed, these bugs can be…

  • Month of Search Engines Bugs Results Published

    Posted by Robert A on

    in
    | |

    "In the project took part 33 search engines (30 web engines and 3 local engines) of 19 vendors, some vendors have several engines. The list of project’s participants (in order of appearance): Meta, Yahoo, HotBot, Gigablast, MSN, Clusty, Yandex, Yandex.Server (local engine), Search Europe, Rambler, Ask.com, Ezilon, AltaVista, AltaVista local (local engine), MetaCrawler, Mamma, Google,…

  • Sun JRE Vulnerabilities

    Posted by Robert A on

    in
    | |

    "A buffer overflow vulnerability in the image parsing code in the Java Runtime Environment may allow an untrusted applet or application to elevate its privileges. For example, an applet may grant itself permissions to read and write local files or execute local applications that are accessible to the user running the untrusted applet." Article Link:…

  • IIS 5.x Vuln Exploit released

    Posted by Robert A on

    in
    | |

    I just found out about this myself and hadn’t seen any news on it so posting it here (better late than never!). A vulnerability has been discovered in IIS5 that Microsoft apparently isn’t going to fix allowing an attacker to gain accesses to resources behind NTLM and Basic Auth. Microsoft is suggesting upgrading to IIS6…

  • Unpatched input validation flaw in Firefox 2.0.0.4

    Posted by Robert A on

    in
    | |

    Thor Larholm writes "Firefox 2.0.0.4 fixed a directory traversal vulnerability that allowed you to read local files. However, the patch only works for the Windows version of Firefox and actually re-introduces a previously fixed input validation flaw." More information at http://larholm.com/2007/06/04/unpatched-input-validation-flaw-in-firefox-2004/ Link to this Story: Unpatched input validation flaw in Firefox 2.0.0.4

  • Google Web Service Vulnerability leaks Database Username and Password

    Posted by Robert A on

    in
    | |

    A vulnerability in google has been released on http://www.0x000000.com/index.php. "A large hole has been found inside Google’s service: "the removal of websites tool" Earlofgrey reported about it today. There was not much info available, so I decided to check it out myself before it is plugged. Apparently it is a simple directory that wasn’t protected,…

  • Firefox 0day local file reading

    Posted by Robert A on

    in
    | |

    Thor Larholm writes "We can expect a Firefox 2.0.0.4 release anyday now, as there is a publicly known 0day local file reading vulnerability in Firefox – see http://larholm.com/2007/05/25/firefox-0day-local-file-reading/

  • Widescale Unicode Encoding Implementation Flaw Discovered

    Posted by Robert A on

    in
    ,
    | |

    Amit Klein was kind enough to point out that the ASP.NET filter evasion issue is actually a known issue. It was first pointed out in 2004! According to that post "We have decided that a KB article and update to tools and/or best practice guidelines should be done for this, and will be as time…

  • Bug hunters face online-apps dilemma

    Posted by Robert A on

    in
    ,
    | |

    "Web applications pose a dilemma for bug hunters: how to test the security without going to jail? If hackers probe traditional software such as Windows or Word, they can do so on their own PCs. That isn’t true for Web applications, which run on servers operated by others. Testing the security there is likely illegal…

  • Virgin security flaw exposes customers’ details

    Posted by Robert A on

    in
    ,
    | |

    "It appears that, instead of using random SMS codes, Virgin Mobile’s codes were sequential so simply changing the last character allowed access to a new set of personal details. For example, someone who received the code "00XM7Z" could view another customer’s details by entering "00XM7Y" or "00XM7X", etc." Article Link http://www.smh.com.au/news/security/virgin-exposes-customers-details…

  • Stats on Month of X bugs published

    Posted by Robert A on

    in
    ,
    | |

    Kevin Beets from avertlabs has published some interesting stats on month of bugs projects including the amount of vulns published verses fixed. For more information visit the article link below. Article Link: http://www.avertlabs.com/research/blog/?p=286

  • Critical Flaws Found in Java Development Kit

    Posted by Robert A on

    in
    | |

    "Two vulnerabilities open to remote exploitation by hackers have been found in Java Development Kit, one of which could be used to take over a compromised system." "One flaw is caused by an integer overflow error in the image parser when processing ICC profiles embedded within JPEG images, according to FrSIRT researchers." Article Link: http://www.eweek.com/article2/0,1895,2132409,00.asp

  • PHP Month of bugs status update #2

    Posted by Robert A on

    in
    | |

    Here is another status update for the month of PHP Bugs. Here are the latest vulnerabilities. * MOPB-11-2007:PHP WDDX Session Deserialization Information Leak Vulnerability * MOPB-10-2007:PHP php_binary Session Deserialization Information Leak Vulnerability * MOPB-09-2007:PHP wddx_deserialize() String Append Buffer Overflow Vulnerability * MOPB-08-2007:PHP 4 phpinfo() XSS Vulnerability (Deja-vu) * BONUS-07-2007:Zend Platform ini_modifier Local Root Vulnerability *…

  • PHP Month of bugs begins, current status update

    Posted by Robert A on

    in
    | |

    The month of PHP Bugs has started. Here are the current vulnerabilities disclosed. * MOPB-01-2007:PHP 4 Userland ZVAL Reference Counter Overflow Vulnerability * MOPB-02-2007:PHP Executor Deep Recursion Stack Overflow * MOPB-03-2007:PHP Variable Destructor Deep Recursion Stack Overflow * MOPB-04-2007:PHP 4 unserialize() ZVAL Reference Counter Overflow * MOPB-05-2007:PHP unserialize() 64 bit Array Creation Denial of Service…

  • Read RSS and get hacked

    Posted by Robert A on

    in
    , ,
    | |

    Computerworld referenced some research that I had done on RSS Security in an article discussing how RSS and other web based feeds can be used as deployment vectors for malware. For those of you reading this entry coming from an RSS feed, no worries I haven’t owned you as it wouldn’t be in my interest…

  • Vulnerability tallies surged in 2006

    Posted by Robert A on

    in
    ,
    | |

    "Flaws in Web applications boosted the bug counts for 2006 by more than a third over the previous year, according to data obtained by SecurityFocus from the four major vulnerability databases. On Monday, the Computer Emergency Response Team (CERT) Coordination Center released its final tally of the number of flaws the organization processed in 2006."…

  • Adobe Client Site Plugin Allows Universal XSS

    Posted by Robert A on

    in
    ,
    | |

    An XSS issue in adobe acrobat allows you to xss a user against any website hosting a PDF file. UPDATE: Download Acrobat 8 it address this issue to protect yourself. If you host PDF files on a site it has been suggested that you associate the PDF mimetype on your web server to something unknown.…

  • Security Fix Released for PHP

    Posted by Robert A on

    in
    | |

    "The PHP development team is proud to announce the immediate release of PHP 5.2.0. This release is a major improvement in the 5.X series, which includes a large number of new features, bug fixes and security enhancements. Further details about this release can be found in the release announcement 5.2.0, the full list of changes…

  • Hailstorm of Microsoft Patches Released

    Posted by Robert A on

    in
    | |

    "Microsoft today issued a record-breaking number of security updates, fixing at least 26 separate security holes in its Windows operating system and other products, including 16 vulnerabilities in Microsoft Office and Office components. By my count, this is the largest number of flaws Microsoft has fixed in one go outside of a Service Pack. Among…

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.