SOLDIERX.COM Nobody Can Stop Information Insemination

Posted by Patrick Webster on May 02

Reminded me of a bug I found in an EAL4 certified military encryption product.

The source code actually says "FIXME - need to add parameter validation."

So instead of spending a few minutes adding input sanitisation, the
developers just added a reminder that none exists and shipped the
product as-is. One of those face slap moments.

-Patrick

Posted by security-news on May 01

View online: http://drupal.org/node/1984212

* Advisory ID: DRUPAL-SA-CONTRIB-2013-046
* Project: Filebrowser [1] (third-party module)
* Version: 6.x
* Date: 2013-May-1
* Security risk: Highly critical [2]
* Exploitable from: Remote
* Vulnerability: Cross Site Scripting

-------- DESCRIPTION
---------------------------------------------------------

Filebrowser module allows site administrators to expose a particular file
system...

Posted by Thierry Zoller on May 01

You got to be kidding me...

Posted by Philippe oechslin on May 01

We found this one year ago. Although most versions have been patched we
haven't seen any public info on this yet.

FORTICLIENT VPN CLIENT CREDENTIAL INTERCEPTION VULNERABILITY
============================================================

Description
-----------
The Fortinet FortiClient VPN client on all available platforms suffers
from a certificate validation vulnerability which allows an attacker
to successfully run a man-in-the-middle...

Posted by Hafez Kamal on May 01

Hi everyone - This is a Call for Papers for the 11th annual HITB
Security Conference in Malaysia, #HITB2013KUL which takes place on the
16th and 17th of October in Kuala Lumpur.

Keynote speakers for the conference will be Joe Sullivan (Chief Security
Officer, Facebook) and Andy Ellis (Chief Security Officer, Akamai)

We're looking for talks that are highly technical, but most importantly,
material which is new and cutting edge. Submissions...

Posted by cfp on May 01

Breakpoint 2013 Call For Papers
Melbourne, Australia, October 24th-25th
Intercontinental Rialto
http://www.ruxconbreakpoint.com

.[x]. Introduction .[x].

The Ruxcon team is pleased to announce Call For Papers for Breakpoint 2013.

Breakpoint showcases the work of expert security researchers from around the
world on a wide range of topics. This conference is organised by the Ruxcon
team and offers a specialised security conference to...

Posted by security on Apr 30

n.runs AG
http://www.nruns.com/ security(at)nruns.com
n.runs-SA-2013.005 30-APR-2013

Posted by Yves-Alexis Perez on Apr 30

-------------------------------------------------------------------------
Debian Security Advisory DSA-2665-1 security () debian org
http://www.debian.org/security/ Yves-Alexis Perez
April 30, 2013 http://www.debian.org/security/faq
-------------------------------------------------------------------------

Package : strongswan
Vulnerability : authentication bypass
Problem...

Posted by security on Apr 30

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:159
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : clamav
Date : April 30, 2013
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________

Problem...

Posted by security on Apr 30

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:158
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : krb5
Date : April 30, 2013
Affected: Business Server 1.0
_______________________________________________________________________

Problem Description:

A...

Posted by security on Apr 30

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:157
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : krb5
Date : April 30, 2013
Affected: Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

Multiple...

Posted by Michal J. on Apr 30

Product: Wowza Media Server
URL: http://www.wowza.com/
Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server

Issue:

By default all installations of WMS use four modules in their
application's config file: base, properties, logging, flvplayback.

I've found out that the `properties` module allows unauthenticated
attacker to get/set various properties (Client, MediaStream,
ApplicationInstance, and Application).

Since...

Posted by Michal J. on Apr 30

Product: Wowza Media Server
URL: http://www.wowza.com/
Description: WMS is a quite popular RTMP/HLS/HDS/RTSP streaming server

Issue:

In early 2009 I reported problem with processing of requests with
relative paths.

The issue surfaced again.

In a nutshell, you can escape Applications StorageDir using relative
path.

Lets say you have two applications:

* vod1 with /usr/local/WowzaMediaServer/content1/ as StorageDir
* vod2 with...

Posted by Kotas, Kevin J on Apr 30

CA20130213-01: Security Notice for CA ControlMinder

Issued: February 13, 2013
Last updated: April 29, 2013

CA Technologies support is alerting customers to a potential risk
with CA ControlMinder. A vulnerability exists that can allow a remote
attacker to execute arbitrary code. CA has issued remediation to
address the vulnerability.

The vulnerability, CVE-2010-0738, occurs due to the default JBoss
Application Server configuration not correctly...

Posted by Vulnerability Lab on Apr 29

Title:
======
PayPal Bug Bounty #45 BillSafe - Remote Auth Bypass Session Web Vulnerability

Date:
=====
2013-04-30

References:
===========
http://www.vulnerability-lab.com/get_content.php?id=804
http://www.vulnerability-lab.com/dev/?p=665

PayPal Security UID: og1eb1mgi

PayPal Inc Bug Bounty: 5000$ (USD)

VL-ID:
=====
804

Common Vulnerability Scoring System:
====================================
8.6

Introduction:
=============
Als...

Posted by CORE Security Technologies Advisories on Apr 29

Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

D-Link IP Cameras Multiple Vulnerabilities

1. *Advisory Information*

Title: D-Link IP Cameras Multiple Vulnerabilities
Advisory ID: CORE-2013-0303
Advisory URL:
http://www.coresecurity.com/advisories/d-link-ip-cameras-multiple-vulnerabilities
Date published: 2013-04-29
Date of last update: 2013-03-29
Vendors contacted: D-Link Corporation
Release mode: Coordinated release

2....

Posted by CORE Security Technologies Advisories on Apr 29

Core Security - Corelabs Advisory
http://corelabs.coresecurity.com

Vivotek IP Cameras Multiple Vulnerabilities

1. *Advisory Information*

Title: Vivotek IP Cameras Multiple Vulnerabilities
Advisory ID: CORE-2013-0301
Advisory URL:
http://www.coresecurity.com/advisories/vivotek-ip-cameras-multiple-vulnerabilities
Date published: 2013-04-29
Date of last update: 2013-04-29
Vendors contacted: Vivotek
Release mode: User release

2. *Vulnerability...

Posted by security on Apr 29

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:156
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : apache-mod_security
Date : April 29, 2013
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________...

Posted by security on Apr 29

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:155
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : fuse
Date : April 29, 2013
Affected: Enterprise Server 5.0
_______________________________________________________________________

Problem Description:

A...

Posted by security on Apr 29

_______________________________________________________________________

Mandriva Linux Security Advisory MDVSA-2013:154
http://www.mandriva.com/en/support/security/
_______________________________________________________________________

Package : util-linux
Date : April 29, 2013
Affected: Business Server 1.0, Enterprise Server 5.0
_______________________________________________________________________...