Oracle refutes 'SSH hacking' slur
160509
Mystery over bogus DenyHosts listing An investigation by Oracle has revealed the none of its systems were involved in launching a recent brute force attack on secure servers around the net.â¦
12873
Oracle is warning customers to apply software patches it released in August because of the availability of malicious code that can exploit unpatched vulnerabilities in its software.
153432
rPath linux has issued an update to their packages for PHP, PHP-MySQL and PHP-PGSql to correct issues that could make it possible for a remote user to gain unauthorized access.   his fixes some vulnerabilities, where some have unknown impacts and others can be exploited by malicious users to bypass certain security restrictions or by malicious people to potentially compromise a vulnerable system.   References and links to the update information can be found in their original advisory.
317024
Rob Richards mentioned in a previous book review about some of the issues he was having getting the Oracle extension enabled on his Fedora 8 system. Well, he's come back after doing some more testing/compiling and has found some resolution to his issues.   I really didn't need to get it running, but the sheer fact that I tried it and it wouldn't work, pissed me off enough to spend some time getting it resolved. Hopefully this helps anyone else having the same problem. I am currently using instant client 11.1, but I did try the 10.2 version with the same results.   He steps through the process he followed - tracking down the missing libaio files, correcting an issue with SELinux loading the Oracle libraries and his realization: he just needed to allow text relocation. Included in the post are the command line calls that'd need to be made to make it all happen.
90
The other day I was thinking about all the edge-cases within Linux and how there are hundreds of little commands and tricks.  I these know now but only after using UNIX for more than 15 years now (has it been that long!).  I wish I would have known all these tricks when I was just getting started.  This is similar to Danny O'Briens Life Hacks  but since so many of us spend our life tied to our shell these are essentially "Shell Hacks".  NetCat is one example.  Very powerful tool with a simple syntax.  Just run 'nc' and you can connect to a host/port and interact with it manually.  You could even write an HTTP client with bash if you really wanted to.  The zsh  shell looks like it might becom ...
402714
Oracle has released 26 fixes across its product line in its latest critical patch update, nine of which repair flaws that are remotely exploitable.In an advisory listing the problems, Oracle advised administrators to patch their machines as quickly as possible.Five of the six vulnerabilities in Oracle&#39;s Application Server can be exploited over a network without the need for a username or password, the company said.The same danger applies to three of seven vulnerabilities in the E-Business Suite and Applications and one of four problems in PeopleSoft Enterprise PeopleTools, Oracle said.In other products, the update includes one patch for Oracle&#39;s Collaboration Suite and eight for various Database products.Oracle fixed a total of 51 vulnerabilities in its last critical patch update in October.&#160;
531535
Phisher 'Vladuz' dodges eBay's defenses &gt;&gt; Advertisement &lt;&lt;  ALERT: "How A Hacker Launches A Blind SQL Injection Attack Step-by-Step"!" - White Paper  Blind SQL Injection can deliver total control of your server to a hacker giving them the ability to read, write and manipulate all data stored in your backend systems! Download this *FREE* white paper from SPI Dynamics for a complete guide to protection! https://download.spidynamics.com/1/ad/bsq.asp?Campaign_ID=701600000004c29
463385
(InfoWorld) - Secure card maker HID Corp. is objecting to a demonstration of a hacking tool at this week's Black Hat Federal security conference in Washington, D.C. that could make it easy to clone a wide range of so-called "proximity" door access cards. HID has sent a letter to IOActive, a security consulting firm, accusing Chris Paget, IOActive's director of research and development, of possible patent infringement over a planned presentation, "RFID for beginners," on Wednesday, a move that could lead to legal action should the talk go forward, according to Jeff Moss, founder and director of Black Hat. IOActive will hold a press conference Tuesday at 9:00AM to discuss the issue, according to Joshua Pennell, IOActive's CEO told InfoWorld. Paget's talk will address widespread security issues with the implementation of RFID in proximity cards that are sold by HID and other companies and that are widely used for building access. His RFID cloner was on display at the recent RSA Security Conference in San Francisco, where he demonstrated for InfoWorld how the device could be used to steal access codes from HID brand proximity cards, store them, then use the stolen codes to fool a HID card reader. Paget's presentation at Black Hat Federal will go deeper, providing schematics and source code that attendees could use to create their own cloning device, and discussing vulnerable implementations of RFID technology in a wide variety of devices, Paget told InfoWorld at RSA earlier this month. "Hopefully I'll be able to give people some information about RFID and get some pressure on vendors to fix these lousy RFID implementations," Paget said. "As it stands, I can walk up to someone on the street or maybe stand next to them in an elevator, grab their card ID and get into the building," he said. So far, Black Hat organizers have not been contacted or asked to cancel Paget's presentation, but lawyers representing Black Hat, which was purchased by CMP, are ready should that happen, Moss said. "We're prepared for the worst," Moss said. The incident between HID and IOActive recalls a 2005 imbroglio between researcher Michael Lynn and Cisco Systems over a presentation of a flaw in Cisco's IOS at a Black Hat event in Las Vegas. In that incident, Cisco attorneys demanded that Lynn's presentation be torn out of the printed conference proceedings and that Lynn be blocked from giving his talk. Lynn ultimately resigned his position at Internet Security Systems Inc. (ISS) and gave the talk anyway, spawning lawsuits and even an FBI investigation of him. Lynn now works as a researcher at Cisco competitor, Juniper Networks. Whereas Lynn's hack of IOS was considered novel, however, the IOActive demonstration of RFID vulnerabilities is largely a rehash of known issues, intended more as an introduction, Moss said. "They've known about this for years and years," Moss said. Kathleen Carroll, a spokeswoman for HID's Government Relations group acknowledged that a letter was sent to IOActive but that it did not mention patent infringement. She said that the company has long been aware that its proximity cards are vulnerable to hacking but does not believe that the cards are as vulnerable as Paget suggests. "For someone to be able to surreptitiously read a card, they'd have to get within two or three inches and get into the same plane as the card," Carroll said. HID is also concerned that Paget's demonstration will popularize the vulnerabilities in its proximity cards and endanger its many customers. "These systems are installed all over the place. It's not just HID, but lots of companies, and there hasn't been a problem. Now we've got a person who's saying let's get publicity for our company and show everyone how to do it, and it puts everyone at risk. Where's the sense of responsibility?" Carroll said. According to Moss, HID has charged Paget with patent infringement over his presentation, but has not laid out any particular remedies or threatened actions, making it difficult to ascertain what the company might do -- if anything -- to block the presentation. Security problems with implementations of RFID are well known and have been publicized before. In 2005, security consultant Jonathan Westhues detailed attacks against implanted VeriChip RFID chips. More recently, in January, Westhues posted detailed code and schematics for an RFID hacking device that can act as a reader, eavesdrop on RFID transactions between reader and a tag, analyze the signal received over the air, or impersonate a tag.Â  In 2005, Avi Rubin and other researchers at Johns Hopkins also sounded the alarm about weak security in RFID implementations by hacking technology from Texas Instruments that is used in late model car ignition systems and electronic payment systems, as well. All that attention hasn't sparked much change at companies like HID, which makes fifteen different types of proximity cards in their Prox Products and Indala Prox Products lines, all of which are believed to be vulnerable to cloning, according to Paget. "Some of these cards have been around for 15 years and were developed when there was no awareness of the problem," Carroll said. Asked why HID hasn't addressed the issue in more recent proximity card systems, after knowledge of RFID threats became common, Carroll said that doing so would cause "major upheaval" among customers.Â  Inertia is a more likely cause, said Dan Kaminsky, director of penetration testing at IOActive. "They didn't want to change to a more secure implementation because of backwards compatibility issues, and they had a lot of sites that use these cards, and HID has stuff to sell them," Kaminsky said. Paget's hack was no feat of engineering wizardry, Kaminsky said. "It took a month -- and he wasn't even working on it full time." The problem is that RFID technology, although good for inventory tracking as a replacement for barcodes, is not well suited for security, Kaminsky said. "The technology is very convenient, but don't interpret the convenience as security," Kaminsky said. "At the end of the day, many companies are essentially using barcode technology to control access to their facilities. I'd posit that perhaps there are more secure technologies out there." HID recommends that customers who are concerned about cloning upgrade to one of HID's smart card products, which do encrypt transmissions between card and reader and are more difficult to hack, Carroll said. HID also recommends that companies that use the cards train their employees to look for suspicious activity that might indicate that someone is trying to clone or spoof access cards. As for Paget's presentation, Moss expressed frustration over HID's actions, especially given the widespread attention to RFID security holes. "It's just so frustrating from a security standpoint. Now anytime someone wants to talk about anything, they need a team of lawyers. Even when it's about commonly understood problems," Moss said. For now, Moss said Black Hat is supporting Paget and his presentation -- even if last minute changes are needed to satisfy HID, Moss said.
274982
Forty-five fixes out. One missing in action Oracle released 45 security patches on Tuesday as part of its latest quarterly patch update, one less than expected.â¦
322890
BOSTON - The U.S. government's Computer Emergency Response Team (US-CERT) and software security companies have issued warnings about a number of security vulnerabilities in versions of Oracle Corp.'s software.
411451
Oracle Corp. released several high-risk vulnerabilities reported last month in its database software and other products, and urged customers to download and install them.
446383
A networking industry exec disagrees with Juniper claim that it's opening up it JUNOS operating system code.
710855
(InfoWorld) - A security researcher has found a serious vulnerability in an aging yet widely used software program used for the Internet's addressing system, prompting the software's maintainers to retire the affected version. The flaw within Berkeley Internet Name Domain 8 (Bind 8) software could misdirect users to a fraudulent Web site even if a user typed in the correct URL (uniform resource locator), wrote Amit Klein, chief technology officer for security vendor Trusteer. Klein discovered the problem. Users are being advised to upgrade to Bind 9.4, the latest version of the software, which underwent an architectureÂ rewrite to improve security. The software, looked after by the Internet Software Consortium (ISC), is free to download. ISC issued an interim patch, but due to other weaknesses in the software, ISC is also ending support for Bind 8. "It's never easy to retire a product," wrote the organization in an advisory. "The security issues of Bind 8 are many, and seven years after the release of Bind 9, ISC must devote our efforts to maintaining and enhancing the current version." About 14 percent of the DNS servers on the Internet in 2006 were still using Bind 8, according to Infoblox, which conducts an annual survey of DNS servers. "Bind 8 is still a very popular DNS server nowadays, thus this attack applies to a big part of Internet users," Klein wrote. In a research paper, Klein described a weakness in the algorithm Bind 8 uses to generate transaction IDs, apparently random serial numbers that allow it to spot whether someone is trying to supply it with false information in respose to queries. The weakness makes it possible to observe a few queries and then predict the transaction ID in the sequence, Klein wrote. Using that information, an attacker can then send erroneous information to the DNS server, "poisoning" the address stored against a particular domain name in its memory cache. Thus, traffic intended for a certain Web site from users of that DNS server can be diverted to another server containing a fraudulent site, a deception known as "pharming." Although Bind 9 has a better transaction ID algorithm, it could also be vulnerable, Klein wrote. Â
611792
US-CERT has issued an alert citing several security flaws in Oracle products that could be used to shut down or take control of vulnerable systems or to corrupt or steal data from Oracle databases.
234843
Vulnerabilities in the Sun Java Runtime Environment are described by one security expert as being "as bad as it gets."
465554
(InfoWorld) - One of the hackers who demonstrated exploit code for a vulnerability in the way the Firefox browser handles Javascript at a hacker conference in San Diego admitted Tuesday that the presentation was meant to be a joke, the chief of security for Mozilla has said. Mozilla security researchers spent most of Sunday and Monday scrambling to determine if exploit code revealed during a presentation by hackers Mischa Spiegelmock and Andrew Wbeelsoi at Toorcon over the weekend could allow someone to execute malicious code through a memory corruption attack on Firefox. However, Window Snyder, who leads Mozilla's security team, said Spiegelmock admitted to the company that the presentation was meant to be humorous, and he and Wbeelsoi had not actually achieved remote execution with the exploit code demonstrated at the show. "At best, in some cases it will crash only the client," Snyder said Tuesday. "That's all we've been able to verify at this point." Spiegelmock, who works for Six Apart Ltd., confirmed as much in his LiveJournal blog, in which he includes a link to a statement he made that is posted on Snyder's Mozilla blog. (http://developer.mozilla.org/devnews/index.php/2006/10/02/update-possible-vulnerability-reported-at-toorcon/) "The main purpose of our talk was to be humorous," according to the statement. "As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has." During the presentation, the hackers also said they knew of 30 other vulnerabilities in Firefox but this, too, was a joke, Snyder said Tuesday. To hear Six Apart spokeswoman Jane Anderson tell it, the Toorcon presentation was a joke invented by two kids barely out of their teens who didn't understand the ramifications of their actions. "It was all a parody," she said. Anderson added that Spiegelmock was not representing Six Apart at the show, and the company spent most of Sunday on the phone with Mozilla putting out fires and cooperating with the company to get to the bottom of the matter. To make matters more embarrassing for Six Apart, the company's earliest investor, Joi Ito, is on Mozilla's board of directors. Anderson added that Spiegelmock will not be terminated for his actions. "We all make mistakes," she said. Snyder and the Mozilla team also are being good sports about the ordeal. "Of course, we always prefer that security researchers report vulnerabilities to us so we can create a patch before customers are put at risk," she said. "But at this point he's been very cooperative and we're pleased he's chosen to work with us." Still, Snyder said, "I know people who were working really hard here on Sunday probably have other things they'd rather be doing."
498125
Hoodies hit Microsoft, big lads do Larry Oracle users could be headed for a Microsoft-scale hack or a major database breach as master criminals begin to target valuable business systems.â¦