Blogs

BIND DNS Cache Poisoning Issue

http://www.isc.org/index.pl?/sw/bind/bind-security.php - A weakness in the DNS protocol could lead to DNS poisoning of caching recursive name servers. This affects all non-DNSSEC protected domains. Newer versions of BIND utilize Query Port Randomization for BIND 9 which helps to mitigate the problem, but is not a full solution. The only proven solution to protect your domain from this attack is to implement DNSSEC on your authoritative name servers.

BIND DNS Cache Poisoning Issue

http://www.isc.org/index.pl?/sw/bind/bind-security.php - A weakness in the DNS protocol could lead to DNS poisoning of caching recursive name servers. This affects all non-DNSSEC protected domains. Newer versions of BIND utilize Query Port Randomization for BIND 9 which helps to mitigate the problem, but is not a full solution. The only proven solution to protect your domain from this attack is to implement DNSSEC on your authoritative name servers.

Serious SSL vulnerability for Debian/Ubuntu

http://lists.debian.org/debian-security-announce/2008/msg00152.html - Debian released this announcement today pertaining to their openssl libraries. It has been determined that a Debian specific patch to openssl has been using a weak and easily determined pseudo random number generator for creating ssl certificates. This patch was made to fix CVE-2008-0166, but ended up creating a new issue. This was introduced into Debians testing environment in September 2006, and was moved into their etch release.

Serious SSL vulnerability for Debian/Ubuntu

http://lists.debian.org/debian-security-announce/2008/msg00152.html - Debian released this announcement today pertaining to their openssl libraries. It has been determined that a Debian specific patch to openssl has been using a weak and easily determined pseudo random number generator for creating ssl certificates. This patch was made to fix CVE-2008-0166, but ended up creating a new issue. This was introduced into Debians testing environment in September 2006, and was moved into their etch release.

Serious SSL vulnerability for Debian/Ubuntu

http://lists.debian.org/debian-security-announce/2008/msg00152.html - Debian released this announcement today pertaining to their openssl libraries. It has been determined that a Debian specific patch to openssl has been using a weak and easily determined pseudo random number generator for creating ssl certificates. This patch was made to fix CVE-2008-0166, but ended up creating a new issue. This was introduced into Debians testing environment in September 2006, and was moved into their etch release.

WordPress PHP Code Execution and Cross-Site Scripting in v2.5 and prior

http://secunia.com/advisories/29965/ - Two vulnerabilities have been discovered, one which can lead to authentication bypass (if account registration is enabled) and another which can lead to arbitrary HTML and code execution on the clients web browser. This could appear to be a defacement, but is executed locally on the users computer, not on the server itself. Test and update to v2.5.1 when possible.

WordPress PHP Code Execution and Cross-Site Scripting in v2.5 and prior

http://secunia.com/advisories/29965/ - Two vulnerabilities have been discovered, one which can lead to authentication bypass (if account registration is enabled) and another which can lead to arbitrary HTML and code execution on the clients web browser. This could appear to be a defacement, but is executed locally on the users computer, not on the server itself. Test and update to v2.5.1 when possible.

Sun Solaris Apache Modules Cross-Site Scripting Vulnerabilities

http://secunia.com/advisories/29988/ - Sun has acknowledged some vulnerabilities in Solaris, which can be exploited by malicious people to conduct cross-site scripting attacks. This affects Apache 1.3.x and 2.0.x running on Solaris 8, 9 and 10 on SPARC and x86. Some vendor patches are available. Please test and apply these patches when available.

Sun Solaris Apache Modules Cross-Site Scripting Vulnerabilities

http://secunia.com/advisories/29988/ - Sun has acknowledged some vulnerabilities in Solaris, which can be exploited by malicious people to conduct cross-site scripting attacks. This affects Apache 1.3.x and 2.0.x running on Solaris 8, 9 and 10 on SPARC and x86. Some vendor patches are available. Please test and apply these patches when available.

Pages