OpenSSH 5.6 Updates Authentication Bugs
According to the developers, the latest release of the free SSH
connectivity tools include a number of bug fixes and several new
features. Read the full article. [The H Security]
Vulnerabilities
Demo of the Microsoft DLL Hijacking Exploit
In this video, the folks at Offensive Security demonstrated exactly how the Windows DLL-hijacking vulnerability can exploited using Metasploit and a benign PowerPoint slide.
UN Site Has 3-Year Old SQL Injection
Three years after the United Nations’ website
was defaced by activist hackers using a SQL injection attack, the site
still contains multiple instances of these vulnerabilities. Read the full article. [Dark Reading]
An in-depth survey carried out amongst 100 of those attending this year’s DEFCON conference revealed that an overwhelming 96 percent of the respondents said they believed the cloud would open up more hacking opportunities for them. Read the full article. [Help Net Security]
A day after Microsoft released information on the remotely exploitable DLL-hijacking vulnerability that affects dozens of Windows applications, researchers are starting to discover exactly which pieces of software are vulnerable. The list so far includes PowerPoint, Wireshark and some applications that are included by default with Windows Vista, and possibly Windows 7.
Dennis Fisher talks with HD Moore about the newly discovered DLL load vulnerability in Windows, which affects several dozen applications and can be used by attackers to silently compromise remote machines, as well as the guidance and workarounds that Microsoft is offering for users and developers
Metasploit’s HD Moore has released technical details on a severe application DLL load hijacking problem that haunts more than 40 Windows software programs.Moore, who stumbled on the issue while researching the recent LNK zero-day flaw, has released an audit kit that can be used to identify affected applications on a particular system.
Two ATM manufacturers have released software updates to address the remotely exploitable vulnerabilities in their machines’ firmware that IOActive researcher Barnaby Jack demonstrated line on stage at the Black Hat conference last month.
The phpMyAdmin developers have announced the release of version 3.3.5.1 and 2.11.10.1 of their database administration tool, security updates that fix one critical and several serious vulnerabilities. Read the full article. [The H Security]
A virus-carrying USB thumb drive has been implicated in the 2008 crash
of a Spanish jetliner, the deadliest air disaster in Spanish history. Read the full article. [El Pais]
