Home Security

Security

SSLv2 Protocol “DROWN” security flaw – CVE-2016-0800

As announced by the OpenSSL team some days ago, a new fix for several high severe vulnerabilities have been released. The main vulnerability is called “DROWN” (once again with a fancy logo, of course). Detailed information can be found on www.drownattack.com CVSS V2 Base Score 5.8 Base Metrics AV:N/AC:M/Au:N/C:P/I:P/A:N Access Vector Network Access Complexity Medium Authentication […]

Critical OpenSSL update is live!

Tricky spam – real message forward with passworded mail attachment

Well folks: It’s getting tricky. When I wrote about CTB-Locker, I joked around that everyone warned their users about suspicious attachments anyway. Now attackers use a new method to get around virus scanners and get their victims to open their infected files. The initial notice came from Heise with a German mail – and the notice […]

Crypto-trojan CTB-Locker infects hundred webservers

CVE-2016-2384: arbitrary code execution due to a double-free in the usb-midi linux kernel driver

CVE-2016-2384 describes an interesting vulnerability within the usb-midi linux kernel driver. There is an extensive blog post on xairy’s github blog. The exploit can be either used for DOS (you’ll need physical access) or to execute code (you’ll need both physical and local access).   CVE-2016-2384 CVSS v2 Base Score 4.7 Base Metrics AV:L/AC:M/Au:N/C:N/I:N/A:C Access Vector Local […]

Short News: Hacked Linux Mint ISOs

CVE-2015-7547: glibc getaddrinfo stack-based buffer overflow vulnerability

A new vulnerability has been discovered by Googles Online Security research team. It affects the glibc library and can potentially lead to DOS and code executions. How severe this is to your infrastructure depends on many factors – it is recommended to patch the issue as soon as possible. “Our initial investigations showed that the […]

Did you secure everything this week?

Short News: Twitch.tv breach

Twitch.tv, the live streaming platform now owned by Amazon.com, might have suffered a data breach. In a short blog post on the Twitch Blog, they state that […] there may have been unauthorized access to some Twitch user account information […] – Twitch Blog They’ve disconnected all associated twitter and steam accounts and forced a […]

Critical OpenSSL update is live!

The new OpenSSL patch I’ve written about yesterday is now released. Shortly before the release they had to fix another issue within the OpenSSL patches which are now released. You can find new Version here: http://openssl.org/source/ – the packages for most linux distributions are probably in the work right now. (Check relevant links below) As the […]

March 19: OpenSSL update

The OpenSSL team announced that there will be security fixes in the OpenSSL releases 1.0.2a, 1.0.1m, 1.0.0r and 0.9.8zf which will be published on the 19th march. The announcement states that the highest severity being fixed is “high”. The highest severity defect fixed by these releases is classified as “high” severity. – OpenSSL Project Team The OpenSSL […]