UPDATE – Viber, a messaging and VoIP application similar to WhatsApp, is in the middle of patching a vulnerability that could allow an attacker to view sensitive information shared between users like images, videos and location information.
Browsing Tag: vulnerabilities
UPDATE – The Apache Software Foundation will re-issue at patch for a ClassLoader manipulation zero-day vulnerability in Struts. The fix is expected to be ready within 72 hours; a workaround is available.
Amidst all of the fallout related to Heartbleed, Oracle is doing its best to keep users apprised of its efforts to patch any and all software that may be vulnerable to the OpenSSL issue.
Swedish VPN providers Mullvad report that private keys moving through OpenVPN installations are not immune to Heartbleed OpenSSL exploits.
Netcraft reports that certificates on 80,000 of the half-million Web servers vulnerable to Heartbleed exploits have been revoked.
A cryptanalysis of TrueCrypt, the second half of an audit of the open source encryption software, will involve a small team of experts who will manually audit the code.
Web application security begins with the developer’s comfort level and familiarity with a programming language. WhiteHat Security’s latest report examines the security of six top languages.
The Heartbleed story advanced over the weekend with word of researchers exploiting the OpenSSL flaw to steal private SSL keys, and the loss of data on websites in the U.K. and Canada.
The initial phase of the TrueCrypt audit has been released and 11 vulnerabilities were uncovered, but no evidence of a backdoor.
Evidence exists the OpenSSL heartbleed bug was being exploited as far back as last November, six months before it was publicly disclosed this week.