SANS unveils top 20 security vulnerabilities
77839
The SANS Institute today released its annual Top-20 list of Internet security vulnerabilities. The list is compiled from recommendations by leading security researchers and companies around the world.
58134
Mozilla Foundation releases new versions of two browsers and an e-mail reader, addressing vulnerabilities that could allow attackers to run malicious code on a user's PC.
663829
The FrSIRT site has posted a new advisory for users of the Vivvo Article Management CMS software about potential holes that could allow for some very large-scale damage to be done.    Multiple vulnerabilities have been identified in Vivvo Article Management CMS, which could be exploited by remote attackers to compromise a vulnerable server.   The first issue is due to an input validation error in the "pdf_version.php" script that does not validate the "id" parameter before being used in SQL statements, which could be exploited by malicious people to conduct SQL injection attacks.   The second vulnerability is due to an input validation error in the "index.php" script that do not validate the "classified_path" parameter, which may be exploited by remote attackers to include local or remote scripts with the privileges of the web server.    Versions 3.2 and higher of the software are effected, and, unfortunately, there has been no patch issued for the issue.
611148
Microsoft Corp. released 10 security fixes for various products Tuesday, including seven that fix flaws the company said pose the highest threat to users.
549959
Microsoft Corp. today released an unprecedented number of software security updates to plug flaws in its products, including seven &quot;critical&quot; defects that it said hackers could use to hijack
259952
Just one day after hackers showed how to exploit a number of flaws in the ActiveX software used by Internet Explorer, Symantec has spotted online criminals using one of the attacks.The attack, which was first observed in the last few hours, is not widespread at present. Symantec Security Response Director Oliver Friedrichs said Tuesday that the company had identified just three Web sites that were hosting the attack code, all of which seem to be linked to the same criminals. But he believes that more attacks are inevitable as the bad guys work the code into their malicious toolkits of software. &quot;Given the fact that the proof of concept is available and works, it&#39;s not exactly rocket science for someone to plug this into [a toolkit],&quot; he said. &quot;That&#39;s likely to happen in short order.&quot;Security researchers Elazar Broad and Krystian Kloskowski have disclosed a slew of ActiveX bugs affecting MySpace and Facebook over the past few days, but the attack reported by Symantec takes advantage of a flaw in an ActiveX control used by Yahoo&#39;s Music Jukebox.After the attackers are able to install software on the victim&#39;s machine, they then begin installing a number of malicious files on the victim&#39;s computer, Symantec said.Broad and Kloskowski also discovered a second ActiveX bug in Yahoo Jukebox, but that flaw is not yet being exploited by attackers, according to Symantec. Another major source of problems is the Aurigma ImageUploader ActiveX control, which is used by Web sites such as Facebook and MySpace to upload pictures into Internet Explorer.Because of all the ActiveX bugs, Security experts are warning users to be cautious while Web browsing. On Tuesday, US-CERT (United States Computer Emergency Readiness Team) published a note encouraging users to disable ActiveX controls, which can be done by setting Internet Explorer&#39;s security level to &quot;high&quot; for the Internet zone.That may not be a realistic option for many consumers, who will find their Internet Explorer browsing experience hobbled without ActiveX, Friedrichs said. But tech-savvy users and corporate IT shops can take steps to disable the untrusted ActiveX controls. In fact, the SANS Internet Storm Center has published free software that disables the controls.Another option for enterprise users is to create a whitelist of approved ActiveX controls, Friedrichs said.Security problems with browser add-ons are very common. In the first half of 2007, Symantec identified 237 browser plugin security flaws. About 89 percent of centered on ActiveX.Yahoo did not immediately respond to an e-mail message requesting comment for this story.
702141
A leading provider of secure content management solutions, Finjan Software, has reported 10 serious security vulnerabilities in Windows XP Service Pace 2. According to the company, the attacker can remotely take control over a machine running Windows XP
546373
Thursday's alpha 8 release exposes several new security features to the public for the first time.
297854
Finjan Software, a provider of proactive secure content management solutions for enterprises, announced today 10 serious security vulnerabilities discovered by Finjanâs Malicious Code Research Center (MCRC) in Windows XP Service Pack 2 (SP2) operating
111115
Blog: The most serious vulnerabilities allow attackers to run code on compromised machines.
438457
(InfoWorld) - Microsoft on Tuesday issued six security updates for Windows, Office, and .Net Framework, patching a total of 11 vulnerabilities -- five of them rated critical. The most serious of the batch is MS07-039, said security analysts who, unlike lastÂ  month, had no trouble naming that critical update as the one which should beÂ  patched first. "By far, this is the top of the list this month," said Andrew Storms, director of security operations at nCircle Network Security Inc. MS07-039 patches a pair of bugs in Active Directory in Windows 2000 Server and Windows Server 2003, the two supported server editions of Microsoft's operating system. The most dangerous of the two is a vulnerability in the way Active Directory validates an LDAP (Lightweight Directory Access Protocol) request.Â  According to Microsoft's write-up, "an attacker who successfully exploited this vulnerability could take complete control of an affected system." "Definitely at the top of today's list," agreed David Dewey, a researcher with IBM Internet Security Systems' X-Force team. "It's definitely exploitable." Dewey should know, since it was a colleague at ISS, Neel Mehta, who discovered the flaw last summer. "Neel's created proof-of-concept code in-house during the time we worked on this with Microsoft," said Dewey. "It would certainly be worth the effort" to exploit this, added Storms. "Active Directory is in the center of every Windows network. There's a lot in there, including the group policy objects that set security -- and everything about every user." Unlike most vulnerabilities, the Active Directory bug can be exploited without any user interaction, and on Windows 2000 Server, the older of the two operating systems, it can be attacked by an anonymous user. Although Windows Server 2003 may look safer at first glance -- an attacker must have valid credentials to exploit the bug on that edition -- looks can be deceiving, said Tom Cross, another X-Force researcher. "In this case, the authentication requirements become less important," said Cross. "Anyone on the network -- an employee, for example -- would by definition have credentials." Worse, said Cross, is that outside attackers could exploit this without a lot of trouble by bundling an MS07-039 exploit with a multi-strike attack that figures on compromising some fraction of enterprise laptops while they're outside the network. Once back inside the enterprise's perimeter, the Active Directory exploit could fire up -- using the credentials of the hijacked notebook -- to grab systems running the supposedly more secure Windows Server 2003. Two of the remaining five bulletins were pegged "critical" by Microsoft, while another two were marked "important." The final update was tagged as "moderate." MS07-036, which patches three vulnerabilities, two of them judged critical and oneÂ  of them a zero-day flaw already out in public, repairs bugs in Excel 2000, 2002, 2003 and 2007. Similar vulnerabilities in other Microsoft Office document formats, including those in Word and PowerPoint, have been used by attackers to slip malicious code into corporations. Some of these attacks have been so narrowly targeted that they're launched against just one user at one company. What's interesting about this update, said a Symantec researcher in an e-mail, is that Microsoft got it wrong back in February when it downplayed the initial report of the Excel threat. Then, Symantec's DeepSight threat network analysts reported Excel 2003 was susceptible to a denial-of-service bug which, if exploited, could crash the program. Four months ago, Microsoft denied that the bugs were actually vulnerabilities. "Microsoft has completed its investigation of new public reports of possibleÂ  vulnerabilities in Microsoft Office 2003 and Microsoft Excel 2003 [and] hasÂ  confirmed that these are not product vulnerabilities," a spokeswoman toldÂ  Computerworld at the time. "They are issues that can cause the application to become unresponsive. Users can restart the application," she said. "[Today's] bulletin includes a fix for a previously disclosed denial-of-service issue from February 2007 which is now billed as having the potential for remote code execution," noted Oliver Friedrichs, director of Symantec's security response group. As Friedrichs pointed out, Microsoft characterized all three bugs patched by MS07-036 as having a "remote code execution" impact, meaning that hackers couldÂ  inject their own malware into a PC after exploiting the Excel flaws. The third critical update, MS07-040, plugs three holes in the .Net Framework, the primary Windows runtime environment called on by developers. Notably, all three vulnerabilities were previewed during a sneak peek at the Syscan'07 security conference last week in Singapore. But the patches may be a ton of trouble to corporate IT managers, said Storms, because the .Net Framework is so widely used by corporate developers of in-house software. "Not only will [companies] have to run QA on the patches, they'll have to run QA on the code that runs on .Net," said Storms. The fixes in MS07-040 apply to all but Version 3.x of .Net Framework, adding additional complexity to in-enterprise application testing. Of the remaining security updates, one fixes a flaw in Publisher 2007, another patches Internet Information Services 5.1 on Windows XP Professional SP2, and the thirdÂ  quashes a bug in Windows Vista's bundled firewall. That last, although rated "moderate," second-from-the-bottom in Microsoft's four-step severity rating system, is worth some reflection, said Symantec's Friedrichs. "Microsoft's decision to rewrite the Windows network stack and its accompanying firewall [for Vista] continues to have long-term security implications," Friedrichs said. "A network stack can take decades of heavy scrutiny in order to become battle hardened. As an operating system's first line of defense, its quality is directly related to its ability to withstand attack." On its own, added Friedrichs, the firewall bug isn't a big deal; the result of an exploit is that the attacker can "see" the system when it should actually be completely invisible to outside probes. "[But] if this logic flaw were combined with a vulnerability in one of the exposed services, this could have more serious, widespread implications." As usual, Microsoft's monthly updates have been posted to Microsoft Update and Windows Update services, and they can also be retrieved through Windows Server Update Services (WSUS).
80281
IT security and research organization The SANS Institute is releasing its annual Top 20 list of Internet security vulnerabilities this week, with the intention of offering organizations at least a starting point for addressing critical issues.
663754
Microsoft has confirmed the existence of a vulnerability affecting the Windows Shell. The issue exists in the WebViewFolderIcon ActiveX control, and exploitation could result in an attacker gaining the same rights as a local user.
292045
At least three critical vulnerabilities are among those fixed by the most recent versions of Mozilla, Firefox and Thunderbird.
11292
Secunia has found that the number of security bugs in the open source Red Hat Linux operating system and Firefox browsers far outstripped comparable products from Microsoft last year.In a report released this week, Secunia also criticized CA for the quality of the code in its anti-virus products, saying that "inherent" code problems are exposing CA products to ongoing security vulnerabilities.On the other hand, "zero-day" security bugs in Firefox were patched more quickly than in Microsoft Internet Explorer, according to the Secunia 2007 Report, released this week.In a review of the number of vulnerabilities found in enterprise anti-virus vendors' products, Secunia found that CA was by far the leader, with 187 vulnerabilities, followed by Symantec with 73. Trend Micro (34), ClamAV (15), McAfee (13) and F-Secure (6) ranked lower on the list.The high figures for Symantec and CA are partly due to their wide range of products, some of which cover areas other than anti-virus, Secunia said.However, the majority of the CA bugs were due to "inherent code problems with some CA products", Secunia said in the report.Of particular concern is CA's range of ARCServe Backup products for laptops and desktops, which Secunia submitted to its Binary Analysis process after several bugs were reported and fixed. The bugs involved errors in processing particular arguments and requests.The analysis found that about 60 reported bugs were still present in the supposedly patched versions.What's more, the analysis found that the vulnerabilities were partly due to "the nature of the product code itself", Secunia said."Unless an overhaul of the code is undertaken, then the product remains susceptible to similar types of vulnerabilities," Secunia said.However CA said in a statement that it has rigorous quality-control measures in place for its software and continues to improve those measures.A number of the vulnerabilities found in Symantec products were due to their use of vulnerable software from third-party developers, Secunia said.One of these is the Autonomy Keyview SDK (software development kit), used in Symantec Mail to view Lotus 1-2-3 files. The component was reported to have a "highly critical" flaw on 12 December, but hasn't yet been patched, leaving some Symantec products vulnerable.Symantec said in a statement that it has published instructions for mitigating the problem and has issued product updates for some affected vendors. IBM, whose Lotus Notes was also affected by the Autonomy bug, has issued its own patch.Operating systems and browsersOut of the operating systems monitored by Secunia -- Windows (98 and onwards), Mac OS X, HP-UX 10.x and 11.x, Solaris 8, 9, and 10 and Red Hat (excluding Fedora) -- Red Hat was found to have by far the most vulnerabilities, at 633, with 99 percent found in third-party components. (Linux distributions are generally composed mostly of third-party software, which is integrated by the distributor.)Red Hat has taken issue with the figures, claiming the accurate number should be 404 vulnerabilities for last year.Solaris came next, with 252 bugs, 80 percent of which were in third-party components. Mac OS X came after that with 235, 62 percent of which were third-party.Windows had only 123 bugs reported, but 96 percent of those were found in the operating system itself. HP-UX had 75 bugs reported, 81 percent of which were in third-party code.Last week, a US Department of Homeland Security (DHS) bug-fixing scheme uncovered an average of one security glitch per 1,000 lines of code in 180 widely used open source software projects.The large number of Red Hat flaws is partly due to the large number and wide variety of components it includes."Red Hat contains two different browsers and graphic interfaces, a number of PDF readers and image editors, and so on," the report said. "Red Hat, HP-UX, and Solaris can easily be used as servers, and as such include and support a large number of third party components, while the same cannot be said of all versions of Windows and Mac OS X."Any consideration of relative OS security should look at factors not covered by the report, such as average patching time for vulnerabilities, Secunia said.In the browser field, Firefox led the way with 64 bugs, compared to 43 for Internet Explorer, and 14 each for Opera and Safari.However, in an examination of zero-day flaws - reported by third parties before a patch was available - Secunia found that Firefox tended to get more patches, sooner, compared to IE.Out of eight zero-day bugs reported for Firefox in 2007, five have been patched, three of those in just over a week. Out of 10 zero-day IE bugs, only three were patched and the shortest patch time was 85 days.ActiveX was hit by the largest number of browser add-on bugs in 2007, with 339 (compared to 45 last year), Secunia said.The figure was propped up by the Month of ActiveX Controls Bugs in May 2007, and by Secunia's discovery of a vulnerable ActiveX component that was used in 40 different products.QuickTime followed with 35 bugs and Java with 21 bugs.
648643
This article discusses current trends in penetration testing for web application security, and in particular discusses a framework for selecting the best tool or tools to use for these increasingly common type of application.
356486
Security flaw involving JPEG files affects at least a dozen Microsoft software applications and operating systems.