Welcome to the Network Security website at the IAS

This website is intended to bring you the latest news, how to's, tools and resources in Information Security.  Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.

The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute.  For a description of these principles, please see our About section.

In keeping with the spirit of the Institute, I encourage questions and open discussions about security.  And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.

Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep


Sun Solaris Apache Modules Cross-Site Scripting Vulnerabilities

http://secunia.com/advisories/29988/ - Sun has acknowledged some vulnerabilities in Solaris, which can be exploited by malicious people to conduct cross-site scripting attacks. This affects Apache 1.3.x and 2.0.x running on Solaris 8, 9 and 10 on SPARC and x86. Some vendor patches are available. Please test and apply these patches when available.

Adobe Products BMP Handling Buffer Overflow Vulnerability

http://secunia.com/advisories/29838/ - Adobe Photoshop Album Starter Edition 3.2 and Adobe After Effects CS3 (and possibly other Adobe products) are vulnerable to a buffer overflow vulnerability that could lead to system compromise. An update is not yet available. Users should avoid opening untrusted BMP files.

Poppler Embedded Fonts Processing Vulnerability

http://secunia.com/advisories/29836/ - Poppler is a PDF rendering engine used by xpdf, evince and other tools. There is a system compromise vulnerability that can be exploited by processing malicious PDF files. RedHat has released poppler-0.5.4-4.4 to fix this vulnerability. It is suggested to test and update to this version during the next outage window.

Nagios Plugins Long Location Header Buffer Overflow Vulnerability

http://secunia.com/advisories/27124/ - A vulnerability in the plugins for Nagios could lead to system compromise. Successful exploitation requires that a connection is made to a malicious web server. This affects versions prior to 1.4.10. Fedora just released updates for nagios-plugins for Fedora 7 and Fedora 8.

Multiple Firefox vulnerabilities could lead to system compromise

http://www.mozilla.com/en-US/firefox/2.0.0.14/releasenotes/ - Multiple vulnerabilities were found in version 2.0.0.12 and 2.0.0.13 which could lead to many different types of information disclosure, cross site scripting and possibly even system compromise. It is recommended to update to v2.0.0.14 at the next outage window. It is also noted that v1.5.x of Firefox has not been supported for almost a year and upgrading to 2.0 is highly recommended.

Multiple Firefox vulnerabilities could lead to system compromise

http://www.mozilla.com/en-US/firefox/2.0.0.14/releasenotes/ - Multiple vulnerabilities were found in version 2.0.0.12 and 2.0.0.13 which could lead to many different types of information disclosure, cross site scripting and possibly even system compromise. It is recommended to update to v2.0.0.14 at the next outage window. It is also noted that v1.5.x of Firefox has not been supported for almost a year and upgrading to 2.0 is highly recommended.

ClamAV Multiple Vulnerabilities

http://secunia.com/advisories/29000/ - Some vulnerabilities have been reported in ClamAV, which can be exploited by malicious people to bypass certain security restrictions, to cause a DoS (Denial of Service), or to compromise a vulnerable system. This affects versions prior to 0.93 and have been fixed in v0.93. It is suggested to test and update to this version as soon as possible for systems scanning email, and during the next outage window for other systems not performing real time scanning.

Pages