Submitted by securityadmin on
https://isc.sans.edu/diary.html?storyid=11506&rss
"Oracle officially released Java 7, including some security updates and several new features and enhancements."
Like other versions of Java, installing Java 7 does not remove prior
versions of Java which users will need to manually remove.
Please respond back to this ticket if you found this security alert helpful.
Submitted by securityadmin on
http://www.h-online.com/security/news/item/phpMyAdmin-updates-close-XSS-
hole-1331093.html
"The phpMyAdmin developers have announced the release of versions 3.4.4
and 3.3.10.4 of their open source database administration tool. According
to the security advisory, these maintenance and security updates close a
hole (CVE-2011-3181) in the Tracking feature that leads to multiple
cross-site scripting (XSS) vulnerabilities."
Submitted by securityadmin on
http://www.h-online.com/security/news/item/phpMyAdmin-updates-close-XSS-
hole-1331093.html
"The phpMyAdmin developers have announced the release of versions 3.4.4
and 3.3.10.4 of their open source database administration tool. According
to the security advisory, these maintenance and security updates close a
hole (CVE-2011-3181) in the Tracking feature that leads to multiple
cross-site scripting (XSS) vulnerabilities."
Submitted by securityadmin on
http://www.zdnet.com/blog/security/kill-tool-released-for-unpatched-apac...
A simple perl script run against an unpatched Apache server could lead
to a Denial of Service (DoS) attack against the server. It causes the
Apache process to spiral out of control, consuming CPU and Memory on the
Host and in some cases, stops entirely.
During the attack, web pages served by the Apache process are slow or
non existent.
Submitted by securityadmin on
http://www.zdnet.com/blog/security/kill-tool-released-for-unpatched-apac...
A simple perl script run against an unpatched Apache server could lead
to a Denial of Service (DoS) attack against the server. It causes the
Apache process to spiral out of control, consuming CPU and Memory on the
Host and in some cases, stops entirely.
During the attack, web pages served by the Apache process are slow or
non existent.
Submitted by securityadmin on
Submitted by securityadmin on
http://www.theregister.co.uk/2011/08/22/skype_security_bug/
"The XSS, or cross-site scripting, vulnerability in Skype 5.5.0.113 is
the result of the voice-over-IP client failing to inspect user-supplied
phone numbers for malicious code, researcher Levent Kayan said. As a
result, attackers might be able to exploit the bug to inject commands or
scripts that hijack the machine running the program.
Submitted by securityadmin on
http://www.php.net/archive/2011.php#id2011-08-23-1
This release fixes two bugs:
* Fixed - crypt() returns only the salt for MD5
* Reverted a change in timeout handling restoring PHP 5.3.6 behavior,
which caused mysqlnd SSL connections to hang
The first in the list is the security alert sent out a couple of days ago
advising all to hold off on updating PHP.
Please reply back to this ticket if you found this security alert useful.
Submitted by securityadmin on
Submitted by securityadmin on
http://www.theregister.co.uk/2011/08/22/skype_security_bug/
"The XSS, or cross-site scripting, vulnerability in Skype 5.5.0.113 is
the result of the voice-over-IP client failing to inspect user-supplied
phone numbers for malicious code, researcher Levent Kayan said. As a
result, attackers might be able to exploit the bug to inject commands or
scripts that hijack the machine running the program.