OpenSSL 1.0x Flaw Open to Code Injection
Security expert Georgi Guninski has pointed out a security issue in the 1.0 branch of OpenSSL that potentially allows SSL servers to compromise clients. Read the full article. [The H Security]
Web Security
A Closer Look at Crimepack’s Exploit Stats
One of the best-selling exploit packs on the market today is called Crimepack. Here is a closer look at the “exploit stats”
sections of a few working Crimepack installations to get a better sense
of which software vulnerabilities are most productive for Crimepack
customers. Read the full article. [Krebs on Security]
Ability to Downgrade Encryption Weakens Kerberos
Significant weaknesses in the common
configuration of Kerberos-based authentication servers could allow
attackers to more easily circumvent security measures in networks that
rely on the open authentication standard, according to research
presented at Black Hat. Read the full article. [Dark Reading]
Taking a page from rival Google’s playbook, Mozilla plans to introduce silent, behind-the-scenes security updating to Firefox 4. Read the full article. [Computerworld]
The U.S. Computer Emergency Readiness Team has issued two warnings on flaws in the embedded systems’ OS technology VxWorks as discovered by researcher HD Moore. One flaw deals with weakness in the hashing algorithm of the API authentication; The second regards debug settings being enabled by default and affects nearly 60 vendors’ products. Read the algorithm warning here. Read the debug warning here. [US CERT]
Features in the four major browsers designed to cloak users’ browser
history often don’t work as billed, according to a research paper that
warns that users may get a false sense of security when using the
built-in privacy settings. Read the full article. [The Register]
Researchers at Def Con created a handful of virtual server instances on
Amazon’s EC2 and used a homemade program to attack the network of a
client — a small business that wanted its connectivity tested. They took the company off the
Internet. The price? Six dollars. Read the full article. [Dark Reading]
Cisco is warning of multiple vulnerabilities in its Firewall Services Module (FWSM) for the Cisco Catalyst 6500 Series Switches and Cisco 7600 Series Routers. Read the full article. [The H Security]
A security researcher has uncovered yet another vulnerability in Adobe
Reader that allows hackers to execute malicious code on computers by
tricking their users into opening booby-trapped files. Read the full article. [The Register]
Six people have been arrested on suspicion of stealing credit cards,
personal information and banking details as part of a suspected online
banking fraud. Read the full article. [Help Net Security]
