Welcome to the Network Security website at the IAS

This website is intended to bring you the latest news, how to's, tools and resources in Information Security.  Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.

The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute.  For a description of these principles, please see our About section.

In keeping with the spirit of the Institute, I encourage questions and open discussions about security.  And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.

Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep


APC Network Management Card web interface vulnerable to cross-site scripting and cross-site request forgery

http://www.kb.cert.org/vuls/id/166739

"The web management interface for the APC Network Monitoring Card (NMC)
used in various APC devices contains cross-site scripting (XSS) and
cross-site request forgery (CSRF/XSRF) vulnerabilities. By convincing a
victim to load a specially crafted URL while authenticated to an NMC, an
attacker could obtain credentials or perform certain actions as the
victim, including turning off the NMC-based device and any systems
attached to it. "

APC Network Management Card web interface vulnerable to cross-site scripting and cross-site request forgery

http://www.kb.cert.org/vuls/id/166739

"The web management interface for the APC Network Monitoring Card (NMC)
used in various APC devices contains cross-site scripting (XSS) and
cross-site request forgery (CSRF/XSRF) vulnerabilities. By convincing a
victim to load a specially crafted URL while authenticated to an NMC, an
attacker could obtain credentials or perform certain actions as the
victim, including turning off the NMC-based device and any systems
attached to it. "

Important sudo security update for RHEL

http://rhn.redhat.com/errata/RHSA-2010-0122.html

"An updated sudo package that fixes two security issues is now available for
Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

The sudo (superuser do) utility allows system administrators to give
certain users the ability to run commands as root.

Important sudo security update for RHEL

http://rhn.redhat.com/errata/RHSA-2010-0122.html

"An updated sudo package that fixes two security issues is now available for
Red Hat Enterprise Linux 5.

This update has been rated as having important security impact by the Red
Hat Security Response Team.

The sudo (superuser do) utility allows system administrators to give
certain users the ability to run commands as root.

Pages