Welcome to the Network Security website at the IAS

This website is intended to bring you the latest news, how to's, tools and resources in Information Security.  Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.

The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute.  For a description of these principles, please see our About section.

In keeping with the spirit of the Institute, I encourage questions and open discussions about security.  And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.

Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep

Apache HTTP Server 2.2.22 Released

Submitted by securityadmin on

http://www.apache.org/dist/httpd/Announcement2.2.html

Six security issues were fixed in Apache 2.2.22, including information disclosure, privilege escalation and DoS vulnerabilities.

"SECURITY: CVE-2011-3368 (cve.mitre.org) Reject requests where the request-URI does not match the HTTP specification, preventing unexpected expansion of target URLs in some reverse proxy configurations.

Canadian Privacy Commissioner Unveils New Tools to Help Young Internet Users Protect Their Privacy

Submitted by ep on


http://www.priv.gc.ca/media/nr-c/2012/nr-c_120124_e.cfm#contenttop


I think that the materials that the Privacy Commissioner of Canada is promoting are great.  Everyone should follow the advice they present to teach their families about online privacy.  Here are the links to three great tools they have launched on their www.youthprivacy.ca website.

Microsoft Security Advisory (2639658) Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege

Submitted by securityadmin on

https://technet.microsoft.com/en-us/security/advisory/2639658

"A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error within the Win32k kernel-mode driver (win32k.sys) when parsing TrueType fonts.

Successful exploitation allows execution of arbitrary code."

Apple Releases Multiple Security Updates

Submitted by securityadmin on

http://www.us-cert.gov/current/index.html#apple_releases_multiple_securi...

"Apple has released security updates for Apple iOS, Safari 5.1.1, OS X Lion v10.7.2, iWork 09, and Apple TV 4.4 to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, obtain sensitive information, and bypass security restrictions.

Apache HTTP Server: mod_proxy reverse proxy exposure

Submitted by securityadmin on

http://seclists.org/fulldisclosure/2011/Oct/232

"When using the RewriteRule or ProxyPassMatch directives to configure a
reverse proxy using a pattern match, it is possible to inadvertently
expose internal servers to remote users who send carefully crafted
requests. The server did not validate that the input to the pattern
match was a valid path string, so a pattern could expand to an
unintended target URL."

Pages