Bugging the Bug Market
The Microsoft bug bounty program has been a success so far and the company is looking for new ways to expand it in the future.
Vulnerabilities
Data Leaks Patched in EE Brightbox Routers; CSRF Vulnerability Remains
EE has patched information disclosure and credential vulnerabilities in its Brightbox home and SMB routers, but a risky cross-site request forgery vulnerability remains.
Hacktivist Collective Takes Credit for Comcast Mail Server Hack
Comcast servers were hacked, yielding a list of the company’s mail servers, passwords and a link to the root file that contains the vulnerability the hackers used.
Adobe released an out-of-band patch for its Flash Player, patching a vulnerability being exploited in the wild.
The Wikimedia Foundation patched a critical remote code execution vulnerability in its MediaWiki software used to power wiki and collaboration sites on the Internet, including Wikipedia.
Bug bounty programs are springing up in more and more places every day, and the latest site to join the list is GitHub.
There are two vulnerabilities in some of Oracle’s older database packages that allow an attacker to access a remote server without a password and even view the server’s filesystem and dump arbitrary files.
A VPN bypass bug in Android’s Jelly Bean 4.3 build disclosed last week is also present in Android’s most recent operating system, KitKat 4.4.
Mozilla has fixed a serious vulnerability in its Thunderbird email application that enables an attacker to bypass the filter in Thunderbird that prevents HTML tags from being used in messages. Exploiting the bug could give an attacker the ability to run code on a user’s machine.
Google plans to offer more than $2.7 million in potential rewards in the next iteration of its Pwnium hacking competition at this year’s CanSecWest conference in Vancouver.
