This website is intended to bring you the latest news, how to's, tools and resources in Information Security. Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.
The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute. For a description of these principles, please see our About section.
In keeping with the spirit of the Institute, I encourage questions and open discussions about security. And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.
Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep
Submitted by securityadmin on
http://www.apache.org/dist/httpd/Announcement2.2.html
Six security issues were fixed in Apache 2.2.22, including information disclosure, privilege escalation and DoS vulnerabilities.
"SECURITY: CVE-2011-3368 (cve.mitre.org) Reject requests where the request-URI does not match the HTTP specification, preventing unexpected expansion of target URLs in some reverse proxy configurations.
Submitted by securityadmin on
http://www.php.net/archive/2012.php#id2012-02-02-1
"The PHP development team would like to announce the immediate
availability of PHP 5.3.10. This release delivers a critical security
fix."
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-0830
Submitted by securityadmin on
Submitted by ep on
http://www.priv.gc.ca/media/nr-c/2012/nr-c_120124_e.cfm#contenttop
I think that the materials that the Privacy Commissioner of Canada is promoting are great. Everyone should follow the advice they present to teach their families about online privacy. Here are the links to three great tools they have launched on their www.youthprivacy.ca website.
Submitted by securityadmin on
Submitted by securityadmin on
Submitted by securityadmin on
https://technet.microsoft.com/en-us/security/advisory/2639658
"A vulnerability has been reported in Microsoft Windows, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to an error within the Win32k kernel-mode driver (win32k.sys) when parsing TrueType fonts.
Successful exploitation allows execution of arbitrary code."
Submitted by securityadmin on
http://www.us-cert.gov/current/index.html#apple_releases_multiple_securi...
"Apple has released security updates for Apple iOS, Safari 5.1.1, OS X Lion v10.7.2, iWork 09, and Apple TV 4.4 to address multiple vulnerabilities. Exploitation of these vulnerabilities may allow an attacker to execute arbitrary code, cause a denial-of-service condition, obtain sensitive information, and bypass security restrictions.
Submitted by securityadmin on
http://seclists.org/fulldisclosure/2011/Oct/232
"When using the RewriteRule or ProxyPassMatch directives to configure a
reverse proxy using a pattern match, it is possible to inadvertently
expose internal servers to remote users who send carefully crafted
requests. The server did not validate that the input to the pattern
match was a valid path string, so a pattern could expand to an
unintended target URL."
Submitted by securityadmin on
http://www.adobe.com/support/security/bulletins/apsb11-26.html
"Critical vulnerabilities have been identified in Adobe Flash Player 10.3.183.7 and earlier versions for Windows, Macintosh, Linux and Solaris, and Adobe Flash Player 10.3.186.6 and earlier versions for Android. These vulnerabilities could cause a crash and potentially allow an attacker to take control of the affected system.