There has been a lot of noise over the past week about the ColdFusion Directory Traversal Vulnerability. If you haven’t heard, the basic issue is that ColdFusion allows the inclusion of just about any file on the server (usually Windows servers) to be included by using either a URL parameter or form parameter. Without special [...]
Archive for the ‘General’ Category
Microsoft drops the patch bomb
August 10th, 2010
No Comments
Well, the August 2010 Microsoft patches are out. And man, are they out! 14 bulletins, 34 vulnerabilities. 8 rated critical. Countless reboots! There’s a lot to go through here, but here is some coverage which may help you evaluate this hot mess of patch: SANS: August 2010 Microsoft Black Tuesday Summary Threatpost: Inside Microsoft’s August [...]
Securing password resets in web apps
August 5th, 2010
6 Comments
Recently a developer asked me about how he should perform password recovery in his new web app. The first recommendation I had was not to do recovery, but reset instead. I searched for some information aimed at developers on password reset functionality and was surprised at what I found. While I found a lot of [...]
Out-of-band patch for .LNK vulnerability
August 2nd, 2010
No Comments
Microsoft has announced that they will be releasing an out-of-band patch for the .LNK vulnerability today (August 2nd), most likely due to the increased use of the vulnerability in malware such as the Stuxnet family (great write-up from Microsoft’s Malware Protection Center blog here). More (excellent) coverage is available at the Krebs On Security blog. [...]
Interesting reports released
August 2nd, 2010
No Comments
In an effort to make sure that those of us not attending the fun in Vegas are left out, a number of interesting security related reports have been released in the past week or so. In all the reports include a lot of data to be digested, but the takeaways from these seem to be: [...]
Interview with Joanna Rutkowska!
May 20th, 2010
No Comments
Several of our recent episodes have focused on crimeware and banking trojans. In SecuraBit Episode 54 – Lions and Tigers and Banking Trojans, OH MY! we had Panda Security’s Sean-Paul Correll discussing Panda’s annual security report that disclosed the fact that 66% of all malware being released attempts to commit financial crime. In SecuraBit Episode [...]
0days for Java Deployment Toolkit
April 9th, 2010
No Comments
Two researchers, Rubén Santamarta (@reversemode) and Tavis Ormandy have both posted proof of concept code today for exploiting a vulnerability in the Java Web Start functionality included in Sun’s Java since Java 6 Update 10. The functionality is designed to make it easier for developers to deploy applications to end users. In both cases the [...]
Adobe and Google may team up for Flash
March 30th, 2010
2 Comments
ZDNet has a post about a rumor that Google and Adobe may team up speculating that this may include bundling Flash with Chrome, both the OS and the browser. We’ve had a lot of posts on Flash vulnerabilities on Securabit (they make a regular appearance during the Vulnerability Roundups), so the first thing that comes [...]
SANS vLive!: Automating Compliance & Windows Domain Audits with David Hoelzer
February 25th, 2010
2 Comments
Based on the positive feedback we received from the vLive! course we promoted with SANS recently, we’re doing it again! Everyone has a Microsoft Windows system, and most of us have a lot of them. How can you know whether or not your systems are configured securely? How do you know that users are following security [...]
