I won’t go into detail about the new Microsoft vulnerability…you all know it’s pretty serious and there are a ton of blogs and websites talking about the dirty details. Hopefully you have all read about it and are getting the word out about patching. However, there are some updates on the status of currently available […]
Exploit status for MS08-067 Read More »
Looks like the exploit code has been released by HD Moore as a Metasploit module. Hope everyone took the DNS patching requests seriously since we all know Metasploit is really easy to use (yes, especially for script kiddies!). If you haven’t patched your DNS yet…do it now! Check here for more information and here to
Exploit in the wild for the Kaminsky DNS vulnerability Read More »
Perhaps someone has figured it out or just decided to announce it but the big DNS vulnerability that Dan Kaminsky told the world about may have been revealed. Apparently a reverse engineer named Halver Flake was pretty close to figuring out how the vulnerability works. Then someone at Matasano apparently posted the details and then
Has the DNS vulnerability been revealed? Read More »
I won’t ramble on about the DNS vulnerability discovered by Dan Kaminsky this week…plenty of other blogs and news sites are covering it. Yes…it’s important, groundbreaking and all that jazz. However, if you want the real scoop especially if you need to convince your employer that this needs to be addressed quickly…then I point you
Seriously…I don’t go looking for web site security issues or vulnerabilities but sometimes you do “stumble” upon them. 😛 Several weeks ago I was looking for an online schedule of events at one of the local community centers where I live so I did what anyone would do and typed in the URL of the
Stumbling upon Security Issues Read More »
I won’t go into all the details since every other security blogger on earth is covering it….however, as a reminder this issue is pretty serious if you had generated any keys on affected Debian or Ubuntu systems. The best summary I have found of the issue with links to all the “toys” that have come
Debian and Ubuntu OpenSSL Vulnerability Read More »
For those of you using phpBB2 (which last I checked was still one of the most popular open source forum software out there), you had better start to think about upgrading to the latest version, phpBB3 Olympus. I have always had a love/hate relationship with phpBB…it has been the most popular target for attackers in
phpBB2 Retirement Plan Announced Read More »
. Breaking News! 90% of all Windows machines are vulnerable to Adobe Flash vulnerabilities…(not really breaking news by any means for security professionals, right?). But for the average home user I certainly hope it is. You see articles all the time talking about the latest client-side vulnerabilities and usually they are just talking about one
Flash, Adobe Reader and Java…Oh My! Read More »
Lots of talk on the net recently about the first “critical” vulnerability (MS08-001) released by Microsoft this year. If exploited, this vulnerability can allow an attacker to run arbitrary code on a remote system bypassing personal firewalls and in the case of Vista, the kernel protection mechanisms. Note that one caveat to this is that
New Windows TCP/IP Vulnerability (MS08-001) Read More »
Once again SANS has released it’s “Top 20” security risks for 2007. This is always a good report and I recommend all security professionals read it. This year they give highlight to two increasing attack vectors, users who are easily misled (aka: Social Engineering) and custom built web applications. Either of these should be of
SANS Top 20 for 2007 Released Read More »
