The two most highly publicized vulnerability disclosures last year also were the most highly criticized disclosures: Dan Kaminsky’s DNS bug and the SSL flaw discovered by a group of independent and academic researchers. The two events played out in similar fashions, with some details coming out in advance of the full disclosures, a partial disclosure, if you will. And that’s where the trouble started.
Browsing Category: Vulnerabilities
Jeff Moss, the founder of DEFCON and Black Hat, discusses the unfolding of the vulnerability economy. Nowadays, instead of exposing high profile zero-day vulnerabilities at conferences, many researchers opt for selling their discoveries on a growing market.
Charlie Miller (right), the security researcher who won last year’s Pwn2Own hacker contest, is predicting that Apple’s Safari browser will be the easiest target this year.
In a note posted on the popular Daily Dave mailing list, Miller describes Safari as “easy pickin’s” and forecasts that at least four zero-day Safari flaws will be used during the contest at CanSecWest later this month.
Opera Software has shipped a high-priority security patch for its flagship Web browser to plug at least three vulnerabilities that expose Windows users to code execution and cross-domain scripting attacks.
The Opera 9.64 upgrade also adds support for DEP (Data Execution Prevention) and ASLR (Address Space Layout Randomization), two anti-exploitation mechanisms that helps to limit the damage from malware attacks on the Windows platform.
A lack of corporate mandates to quickly install Oracle Corp.’s security patches may be leaving many Oracle database installations exposed to vulnerabilities for extended periods of time, according to survey results released last week.
From the article:
The open-source PHP Group has issued a patch for at least four security flaws in the widely-used general-purpose scripting language.
With PHP 5.2.9 (see announcement), the PHP development team corrects a total of 50 bugs, including a publicly-known flaw that allows attackers to read the contents of arbitrary memory locations in certain situations.
Over at Microsoft’s MSDN magazine, there’s a really interesting article by Bryan Sullivan suggesting a defense-in-depth strategy to protect Web sites and applications from cross-site scripting (XSS) and cross-site request forgery (XSRF) attacks.
Security researchers Billy BK Rios and Nitesh Dhanjani infiltrated the phishing ecosystem and learned a great deal about how they operate. In this video, they explain their findings:
More than a month after the US-CERT alerted users to the problems with the instructions for disabling the AutoRun capability in Windows, Microsoft has released a fix for the AutoRun problem.
Websense researcher Hermes Li has posted a blow-by-blow walkthrough (with screenshots) of the Adobe Acrobat/Reader vulnerability that’s currently under attack.
Excerpt from the blog post: