securityadmin's blog

Security Team creates a Rogue CA by targeting MD5 weaknesses

http://www.win.tue.nl/hashclash/rogue-ca/

A group that presented at the the Chaos Communication Congress in Berlin
showed the ability to convert a non-CA certificate into a CA
certificate, breaking the trust of the PKI.

This was done by using a large array of fast computers (200 Playstation
3's) in order to create a CSR that would force a weakly signed
Certificate. This certificate normally would not be allowed to sign
other CSRs.

Security Team creates a Rogue CA by targeting MD5 weaknesses

http://www.win.tue.nl/hashclash/rogue-ca/

A group that presented at the the Chaos Communication Congress in Berlin
showed the ability to convert a non-CA certificate into a CA
certificate, breaking the trust of the PKI.

This was done by using a large array of fast computers (200 Playstation
3's) in order to create a CSR that would force a weakly signed
Certificate. This certificate normally would not be allowed to sign
other CSRs.

Multiple vulnerabilities found in Drupal Core <5.13 and <6.7

http://drupal.org/user/124982

This bug affects the update mechanism in Drupal. Via cross site
scripting, a malicious user may be able to cause the superuser to
execute old updates that may damage the database.

Upgrading to 5.13 or 6.7 will mitigate the bug. Alternatively, a patch
is available that will fix this bug, although it will not update other
non-security fixes in the code.

Multiple vulnerabilities found in Drupal Core <5.13 and <6.7

http://drupal.org/user/124982

This bug affects the update mechanism in Drupal. Via cross site
scripting, a malicious user may be able to cause the superuser to
execute old updates that may damage the database.

Upgrading to 5.13 or 6.7 will mitigate the bug. Alternatively, a patch
is available that will fix this bug, although it will not update other
non-security fixes in the code.

Multiple vulnerabilities in Adobe Acrobat Reader [Fwd: [sns.ias.edu #1633]

http://secunia.com/advisories/29773/
http://www.kb.cert.org/vuls/id/593409

Multiple vulnerabilities in Adobe Acrobat/Reader in versions could lead to arbitrary code execution when a user opens a malicious PDF
file.

There are known exploits for these vulnerabilities. Users should use
caution when opening PDF files and upgrade to version 8.1.3 or 9 of
Adobe Acrobat/Reader.

Multiple vulnerabilities in Adobe Acrobat Reader [Fwd: [sns.ias.edu #1633]

http://secunia.com/advisories/29773/
http://www.kb.cert.org/vuls/id/593409

Multiple vulnerabilities in Adobe Acrobat/Reader in versions could lead to arbitrary code execution when a user opens a malicious PDF
file.

There are known exploits for these vulnerabilities. Users should use
caution when opening PDF files and upgrade to version 8.1.3 or 9 of
Adobe Acrobat/Reader.

MS08-067 netapi32.dll Critical security update released out of Cycle from Microsoft

It appears that a vulnerability in netapi32.dll was released out of the
normal security update cycle from Microsoft. This vulnerability allows
for remote code execution.

Apparently it affects all supported version of Windows that have been
configured in one of two ways:

1) Firewall is disabled
2) Firewall is enabled but file/printer sharing is also enabled.

Here is a link to the bulletin and a review (which has more information).

Possible compromised openssh packages from RedHat for RHEL4 and RHEL5

http://www.redhat.com/security/data/openssh-blacklist.html - RedHats distribution servers were infiltrated and some openssh packages were compromised. There is a small possibility that some RHEL4 and RHEL5 systems who updated during the compromise have installed malicious openssh packages. RedHat has released a script to determine if the system has been compromised. It is suggested that the script (available at the URL above) be run on all RHEL4 and RHEL5 machines to determine compromise.

Pages