Welcome to the Network Security website at the IAS

This website is intended to bring you the latest news, how to's, tools and resources in Information Security.  Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.

The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute.  For a description of these principles, please see our About section.

In keeping with the spirit of the Institute, I encourage questions and open discussions about security.  And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.

Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep

Microsoft Security Advisory (2639658) Vulnerability in TrueType Font Parsing Could Allow Elevation of Privilege

Submitted by securityadmin on

https://technet.microsoft.com/en-us/security/advisory/2639658

"A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to compromise a user's system.

The vulnerability is caused due to an error within the Win32k kernel-mode driver (win32k.sys) when parsing TrueType fonts.

Successful exploitation allows execution of arbitrary code."

Apple Releases Multiple Security Updates

Submitted by securityadmin on

http://www.us-cert.gov/current/index.html#apple_releases_multiple_securi...

"Apple has released security updates for Apple iOS, Safari 5.1.1, OS X Lion v10.7.2, iWork 09, and Apple TV 4.4 to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, obtain sensitive information, and bypass security restrictions.

Apache HTTP Server: mod_proxy reverse proxy exposure

Submitted by securityadmin on

http://seclists.org/fulldisclosure/2011/Oct/232

"When using the RewriteRule or ProxyPassMatch directives to configure a
reverse proxy using a pattern match, it is possible to inadvertently
expose internal servers to remote users who send carefully crafted
requests. The server did not validate that the input to the pattern
match was a valid path string, so a pattern could expand to an
unintended target URL."

Security update available for Adobe Flash Player (APSB11-26)

Submitted by securityadmin on

http://www.adobe.com/support/security/bulletins/apsb11-26.html

"Critical vulnerabilities have been identified in Adobe Flash Player 10.3.183.7 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier versions for Android. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.

Skype Confirms XSS Vulnerability in iPhone App

Submitted by securityadmin on

http://www.h-online.com/security/news/item/Skype-confirms-XSS-vulnerabil...

"An XSS bug in the iPhone and iPad version of the Skype client, in combination with an incorrect WebKit setting, allows an attacker to directly access files on the device, including the user's Address Book. The XSS bug itself is an incorrect encoding of the incoming user's 'Full Name' which allows JavaScript code to be embedded in it."

phpMyAdmin Multiple Script Insertion Vulnerabilities PMASA-2011-14

Submitted by securityadmin on

http://www.phpmyadmin.net/home_page/security/PMASA-2011-14.php

"Firstly, if a row contains javascript code, after inline editing this row and saving, the code is executed. Secondly, missing sanitization on the db, table and column names leads to XSS vulnerabilities."

Please respond back to this ticket if you found this security alert helpful.

Security updates available for Adobe Reader and Acrobat

Submitted by securityadmin on

http://www.adobe.com/support/security/bulletins/apsb11-24.html

"Critical vulnerabilities have been identified in Adobe Reader X (10.1) and earlier versions for Windows and Macintosh, Adobe Reader 9.4.2 and earlier versions for UNIX, and Adobe Acrobat X (10.1) and earlier versions for Windows and Macintosh. These vulnerabilities could cause the application to crash and potentially allow an attacker to take control of the affected system."

phpMyAdmin updates close XSS hole

Submitted by securityadmin on

http://www.h-online.com/security/news/item/phpMyAdmin-updates-close-XSS-
hole-1331093.html

"The phpMyAdmin developers have announced the release of versions 3.4.4
and 3.3.10.4 of their open source database administration tool. According
to the security advisory, these maintenance and security updates close a
hole (CVE-2011-3181) in the Tracking feature that leads to multiple
cross-site scripting (XSS) vulnerabilities."

Pages