This website is intended to bring you the latest news, how to's, tools and resources in Information Security. Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.
The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute. For a description of these principles, please see our About section.
In keeping with the spirit of the Institute, I encourage questions and open discussions about security. And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.
Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep
Submitted by securityadmin on
http://www.us-cert.gov/current/index.html#apple_releases_multiple_securi...
"Apple has released security updates for Apple iOS, Safari 5.1.1, OS X Lion v10.7.2, iWork 09, and Apple TV 4.4 to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, obtain sensitive information, and bypass security restrictions.
Submitted by securityadmin on
http://seclists.org/fulldisclosure/2011/Oct/232
"When using the RewriteRule or ProxyPassMatch directives to configure a
reverse proxy using a pattern match, it is possible to inadvertently
expose internal servers to remote users who send carefully crafted
requests. The server did not validate that the input to the pattern
match was a valid path string, so a pattern could expand to an
unintended target URL."
Submitted by securityadmin on
http://www.adobe.com/support/security/bulletins/apsb11-26.html
"Critical vulnerabilities have been identified in Adobe Flash Player 10.3.183.7 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier versions for Android. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.
Submitted by securityadmin on
http://www.h-online.com/security/news/item/Skype-confirms-XSS-vulnerabil...
"An XSS bug in the iPhone and iPad version of the Skype client, in combination with an incorrect WebKit setting, allows an attacker to directly access files on the device, including the user's Address Book. The XSS bug itself is an incorrect encoding of the incoming user's 'Full Name' which allows JavaScript code to be embedded in it."
Submitted by securityadmin on
Submitted by securityadmin on
http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php
"Firstly, if a row contains javascript code, after inline editing this row and saving, the code is executed. Secondly, missing sanitization on the db, table and column names leads to XSS vulnerabilities."
Please respond back to this ticket if you found this security alert helpful.
Submitted by securityadmin on
http://www.adobe.com/support/security/bulletins/apsb11-24.html
"Critical vulnerabilities have been identified in Adobe Reader X (10.1) and earlier versions for Windows and Macintosh, Adobe Reader 9.4.2 and earlier versions for UNIX, and Adobe Acrobat X (10.1) and earlier versions for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system."
Submitted by securityadmin on
https://isc.sans.edu/diary.html?storyid=11506&rss
"Oracle officially released Java 7, including some security updates and several new features and enhancements."
Like other versions of Java, installing Java 7 does not remove prior
versions of Java which users will need to manually remove.
Please respond back to this ticket if you found this security alert helpful.
Submitted by securityadmin on
http://www.h-online.com/security/news/item/phpMyAdmin-updates-close-XSS-
hole-1331093.html
"The phpMyAdmin developers have announced the release of versions 3.4.4
and 3.3.10.4 of their open source database administration tool. According
to the security advisory, these maintenance and security updates close a
hole (CVE-2011-3181) in the Tracking feature that leads to multiple
cross-site scripting (XSS) vulnerabilities."
Submitted by securityadmin on
http://www.h-online.com/security/news/item/phpMyAdmin-updates-close-XSS-
hole-1331093.html
"The phpMyAdmin developers have announced the release of versions 3.4.4
and 3.3.10.4 of their open source database administration tool. According
to the security advisory, these maintenance and security updates close a
hole (CVE-2011-3181) in the Tracking feature that leads to multiple
cross-site scripting (XSS) vulnerabilities."