Welcome to the Network Security website at the IAS

This website is intended to bring you the latest news, how to's, tools and resources in Information Security.  Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.

The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute.  For a description of these principles, please see our About section.

In keeping with the spirit of the Institute, I encourage questions and open discussions about security.  And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.

Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep


ldd arbitrary code execution

http://www.catonmat.net/blog/ldd-arbitrary-code-execution/

Seasoned Unix admins may already know the pitfalls of blindly running
ldd on unknown executables. However, since this article was recently
released, I thought it might be good as a reminder to everyone to be
careful when using it.

This article shows some techniques on how to cause ldd to run arbitrary
code, and how easy it is to trick a sysadmin into executing that code as
root.

ldd arbitrary code execution

http://www.catonmat.net/blog/ldd-arbitrary-code-execution/

Seasoned Unix admins may already know the pitfalls of blindly running
ldd on unknown executables. However, since this article was recently
released, I thought it might be good as a reminder to everyone to be
careful when using it.

This article shows some techniques on how to cause ldd to run arbitrary
code, and how easy it is to trick a sysadmin into executing that code as
root.

ldd arbitrary code execution

http://www.catonmat.net/blog/ldd-arbitrary-code-execution/

Seasoned Unix admins may already know the pitfalls of blindly running
ldd on unknown executables. However, since this article was recently
released, I thought it might be good as a reminder to everyone to be
careful when using it.

This article shows some techniques on how to cause ldd to run arbitrary
code, and how easy it is to trick a sysadmin into executing that code as
root.

VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

"1. Summary

Updated Java JRE packages and Tomcat packages address several security
issues. Updates for the ESX Service Console and vMA include kernel,
ntp, Python, bind libxml, libxml2, curl and gnutil packages. ntp is
also updated for ESXi userworlds.

VMware vCenter and ESX update release and vMA patch release address multiple security issue in third party components

http://www.vmware.com/security/advisories/VMSA-2009-0016.html

"1. Summary

Updated Java JRE packages and Tomcat packages address several security
issues. Updates for the ESX Service Console and vMA include kernel,
ntp, Python, bind libxml, libxml2, curl and gnutil packages. ntp is
also updated for ESXi userworlds.

MySQL OpenSSL Server Certificate yaSSL Security Bypass Vulnerability

http://www.securityfocus.com/bid/37076/discuss

"MySQL is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security
restrictions and obtain sensitive information that may lead to further
attacks.

Versions prior to MySQL 5.1.41 are vulnerable."

It is recommended to update to the latest version of MySQL as soon as
possible.

MySQL OpenSSL Server Certificate yaSSL Security Bypass Vulnerability

http://www.securityfocus.com/bid/37076/discuss

"MySQL is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass certain security
restrictions and obtain sensitive information that may lead to further
attacks.

Versions prior to MySQL 5.1.41 are vulnerable."

It is recommended to update to the latest version of MySQL as soon as
possible.

Pages