Welcome to the Network Security website at the IAS

This website is intended to bring you the latest news, how to's, tools and resources in Information Security.  Security Awareness of our Faculty, Members and Staff is key in creating a safer computing environment.

The three major Principles of Information Security, Availability, Integrity and Confidentiality, will be covered throughout the security awareness program at the Institute.  For a description of these principles, please see our About section.

In keeping with the spirit of the Institute, I encourage questions and open discussions about security.  And if you discover anything out of the ordinary, please feel free to bring it to my attention so that we can work together to create a more productive, safer environment.

Thanks,
Brian Epstein <security@ias.edu>
twitter: @epepepep


Multiple Firefox vulnerabilities could lead to system compromise

http://www.mozilla.com/en-US/firefox/2.0.0.14/releasenotes/ - Multiple vulnerabilities were found in version 2.0.0.12 and 2.0.0.13 which could lead to many different types of information disclosure, cross site scripting and possibly even system compromise. It is recommended to update to v2.0.0.14 at the next outage window. It is also noted that v1.5.x of Firefox has not been supported for almost a year and upgrading to 2.0 is highly recommended.

phpMyAdmin SQL Injection Vulnerability

http://secunia.com/advisories/29200/ - By coaxing a phpMyAdmin user to view a malicious file on the same web server as phpMyAdmin, it is possible to overwrite a vulnerable cookie on that users system. This cookie could allow for arbitrary SQL injection via phpMyAdmin. This vulnerability poses low to no risk as the attack method requires access to the web server hosting phpMyAdmin. It is recommended that the available patch to version 2.11.5 should be applied during the next update schedule for phpMyAdmin.

phpMyAdmin SQL Injection Vulnerability

http://secunia.com/advisories/29200/ - By coaxing a phpMyAdmin user to view a malicious file on the same web server as phpMyAdmin, it is possible to overwrite a vulnerable cookie on that users system. This cookie could allow for arbitrary SQL injection via phpMyAdmin. This vulnerability poses low to no risk as the attack method requires access to the web server hosting phpMyAdmin. It is recommended that the available patch to version 2.11.5 should be applied during the next update schedule for phpMyAdmin.

Ghostscript buffer overflow vulnerability

http://secunia.com/advisories/29103/ - In versions prior to 8.62, a zseticcspace() buffer overflow could result in arbitrary code execution by a malicious user. It would require the malicious user to upload a malicious postscript file to a system or coax a user into viewing a malicious postscript file. It is recommended to update to v8.62.

phpMyAdmin SQL Injection Vulnerability

http://secunia.com/advisories/29200/ - By coaxing a phpMyAdmin user to view a malicious file on the same web server as phpMyAdmin, it is possible to overwrite a vulnerable cookie on that users system. This cookie could allow for arbitrary SQL injection via phpMyAdmin. This vulnerability poses low to no risk as the attack method requires access to the web server hosting phpMyAdmin. It is recommended that the available patch to version 2.11.5 should be applied during the next update schedule for phpMyAdmin.

Ghostscript buffer overflow vulnerability

http://secunia.com/advisories/29103/ - In versions prior to 8.62, a zseticcspace() buffer overflow could result in arbitrary code execution by a malicious user. It would require the malicious user to upload a malicious postscript file to a system or coax a user into viewing a malicious postscript file. It is recommended to update to v8.62.

Pages