Welcome to the Network Security website at the IAS

This website is intended to bring you the latest news, how to's, tools and resources in Information Security.  Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.

The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute.  For a description of these principles, please see our About section.

In keeping with the spirit of the Institute, I encourage questions and open discussions about security.  And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.

Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep


MIT Kerberos kadmind 'server_stubs.c' Remote Denial Of Service Vulnerability

http://www.securityfocus.com/bid/39247

"MIT Kerberos is prone to a remote denial-of-service vulnerability in
'kadmind'.

An attacker may exploit this issue to cause the affected application to
crash, denying service to legitimate users.

MIT Kerberos 5 1.5 through 1.6.3 are vulnerable. "

Patches are available for MIT Kerberos, RHEL and Ubuntu. It is
recommended that users upgrade to the latest release to avoid exploitation.

Thanks,
Brian

Microsoft Security Bulletin Advance Notification for April 2010 including 8 remote vulnerabilities

http://www.microsoft.com/technet/security/bulletin/ms10-apr.mspx

Tuesday, April 13, 2010 is patch Tuesday. Microsoft released this
bulletin summarizing the patches it will release.

8 of these patches mitigate remotely exploitable vulnerabilities.

Users should install these patches during their regular patch Tuesday
patch window.

Thanks,
Brian

PDF Execution function deemed dangerous

http://blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_functio...

A design feature in PDF allows for the execution of a program from
within the PDF. Most PDF readers supply a warning about executing the
program before continuing.

A researcher last week showed how the warning message could be rewritten
by a malicious PDF and trick the user into allowing it to execute. It
could potentially infect other PDFs or run whatever the attacker desired.

PDF Execution function deemed dangerous

http://blogs.adobe.com/adobereader/2010/04/didier_stevens_launch_functio...

A design feature in PDF allows for the execution of a program from
within the PDF. Most PDF readers supply a warning about executing the
program before continuing.

A researcher last week showed how the warning message could be rewritten
by a malicious PDF and trick the user into allowing it to execute. It
could potentially infect other PDFs or run whatever the attacker desired.

XSS Vulnerability in NextGEN Gallery Wordpress Plugin

http://www.coresecurity.com/content/nextgen-gallery-xss-vulnerability

"An XSS[1] vulneravility has been discovered in NextGEN Gallery[2], a
very popular and commonly used plugin for the Wordpress content
management system commonly found as a blogging platform. This
vulnerability results from reflected unsanitized imput that can be
crafted into an attack by a malicious user by manipulating the mode
parameter of the xml/media-rss.php script."

Vulnerable packages

Apple Safari for Windows Prior to 4.0.5 Integer Overflow Vulnerability

http://www.securityfocus.com/bid/38674

"Safari is prone to an integer overflow vulnerability.

Successfully exploiting this issue may allow remote attackers to execute
arbitrary code in the context of the application. Failed attacks will
likely cause denial-of-service conditions."

Apple has released version 4.0.5 of the software. It is recommended
that users update to this release.

Thanks,
Brian

Apple Safari for Windows Prior to 4.0.5 Integer Overflow Vulnerability

http://www.securityfocus.com/bid/38674

"Safari is prone to an integer overflow vulnerability.

Successfully exploiting this issue may allow remote attackers to execute
arbitrary code in the context of the application. Failed attacks will
likely cause denial-of-service conditions."

Apple has released version 4.0.5 of the software. It is recommended
that users update to this release.

Thanks,
Brian

Oracle Java SE and Java for Business Critical Patch Update Advisory - Fixes 27 vulnerabilities

http://www.oracle.com/technology/deploy/security/critical-patch-updates/...

"Due to the threat posed by a successful attack, Oracle strongly
recommends that customers apply CPU fixes as soon as possible. This
Critical Patch Update contains 27 new security fixes across all products.
Supported Products Affected

Pages