By Sowhat of Nevis Labs
Date: 2008.05.14
http://www.nevisnetworks.com
http://secway.org/advisory/AD20080514.txt
CVE: CVE-2008-1437
Date: 2008.05.14
http://www.nevisnetworks.com
http://secway.org/advisory/AD20080514.txt
CVE: CVE-2008-1437
- 5月 15 週四 200811:18
[secway]Microsoft Malware Protection Engine TWO DoS Vulnerabilities
- 5月 15 週四 200811:05
[milw0rm]Internet Explorer "Print Table of Links" Cross-Zone Scripting Vulnerability
<!--
Internet Explorer "Print Table of Links" Cross-Zone Scripting Vulnerability
Author: Aviv Raff
http://aviv.raffon.net/
Summary
Internet Explorer "Print Table of Links" Cross-Zone Scripting Vulnerability
Author: Aviv Raff
http://aviv.raffon.net/
Summary
- 5月 15 週四 200810:27
DragonSoft Secure Scanner 於 May 15, 2008 更新弱點資料庫
弱點資料庫新增 7 個安全弱點:
TO SUBSCRIBE, UNSUBSCRIBE, OR CHANGE YOUR SUBSCRIPTION, go to:
http://www.dragonsoft.com/english/epaper/
DragonSoft Vulnerability and Threat Knowledge Base:
TO SUBSCRIBE, UNSUBSCRIBE, OR CHANGE YOUR SUBSCRIPTION, go to:
http://www.dragonsoft.com/english/epaper/
DragonSoft Vulnerability and Threat Knowledge Base:
- 5月 15 週四 200809:57
[轉貼][zz]Deconstructing PCI 6.6
Trey Ford, director of solutions architecture, WhiteHat Security May 12, 2008
The addition of stringent industry guidelines for web application security is long overdue. With the escalating threat of web attacks, organizations must remain vigilant. Web applications are a special breed of living code -- always online, always accessible, always being modified, and always subject to attack. Diligent web application security demands frequent assessment/attack research and findings targeting specific web applications are posted daily.
Requirement 6.6 is currently the subject of debate due to confusing terminology and the objective has been veiled by clever vendor marketing campaigns promoting specific solutions.
What does PCI Requirement 6.6 really say?
Requirement 6 is about "developing and maintaining secure applications and systems." Requirement 6.1 requires that vendor-supplied security patches be applied within one month of release. Securing and fixing custom application code is not quite as easy as downloading a patch from your favorite software vendor. web application vulnerabilities must be identified, fixes developed, tested, and deployed. In short, you're on your own for the entire process.
Specifically, PCI Requirement 6.6 mandates the following:
PCI DSS version 1.1 Requirement 6.6: Ensure that web-facing applications are protected against known attacks by applying either of the following methods:
The addition of stringent industry guidelines for web application security is long overdue. With the escalating threat of web attacks, organizations must remain vigilant. Web applications are a special breed of living code -- always online, always accessible, always being modified, and always subject to attack. Diligent web application security demands frequent assessment/attack research and findings targeting specific web applications are posted daily.
Requirement 6.6 is currently the subject of debate due to confusing terminology and the objective has been veiled by clever vendor marketing campaigns promoting specific solutions.
What does PCI Requirement 6.6 really say?
Requirement 6 is about "developing and maintaining secure applications and systems." Requirement 6.1 requires that vendor-supplied security patches be applied within one month of release. Securing and fixing custom application code is not quite as easy as downloading a patch from your favorite software vendor. web application vulnerabilities must be identified, fixes developed, tested, and deployed. In short, you're on your own for the entire process.
Specifically, PCI Requirement 6.6 mandates the following:
PCI DSS version 1.1 Requirement 6.6: Ensure that web-facing applications are protected against known attacks by applying either of the following methods:
- 5月 15 週四 200809:55
[轉貼]PHP security analysis
There are many tools out in market for security analysis of PHP codes. Some of them are mentioned below:
1. PHP Security Scanner:
- 5月 13 週二 200814:27
[中國黑客聯盟]被微軟「深度隱藏」的文件
概要:
在你的計算機裡有很多微軟試圖隱藏的文件目錄.在這些目錄中你會(主要)發現有這樣兩種東西:Microsoft Internet Explorer記錄了你所訪問過的所有站點---即使你已經清空了你的緩存,Microsoft Outlook和Microsoft Outlook Express記錄了你所有的E-MAIL信息--即使你已經從垃圾箱中把他們清除(其中也包括來往信件中的附件).請相信我,我所說的還不到實際的 50%.
我之所以說這些文件都隱藏得很好,是因為他們確實隱藏得非常好.以至於如果你沒有什麼DOS的知識,那你就不可能找到這些東西. 我之所以這麼說是因為其中有些文件只能在DOS或只能在Windows Explorer裡顯示.還有些文件在DOS和Windows裡都不能顯示,但是可以通過一個特定的工作環境來顯示他們.基本上以下我所提到的東西如果你並不事先知道他們的存在,那麼在日常的使用過程中遇到他們的機會是微乎其微的.
為了向你們展示這些隱藏的文件是多麼的卑鄙,我舉個簡單的例子,其中有三個隱藏的文件夾包括了:你的姓名,地址,電話號碼,你所訪問過的網站,你所發出或接受到的每一封E-MAIL,你所發出或接受到的每一個附件,你通過搜索引擎所查找的每一個關鍵字,你所下載的每一個文件名,包含有"敏感"信息的文檔名,你的所有Cookies的副本,來自你的HOTMAIL賬戶的完全可讀的E-MAIL,你的PGP密匙,還有更多...
有趣的是以上的所有在microsoft的官方網站上卻隻字未提.
- 5月 13 週二 200814:24
[大砲開講]台灣電力公司網站存在XSS安全漏洞
2008 年 05 月 13 日 – 09:50:04 台灣電力公司網站被發現存在XSS(Cross-Site Scripting)安全漏洞，到目前為止，尚未修復。(Credit: 天罣) 跨站腳本攻擊(XSS)：駭客利用網站上允許使用者輸入 字元或字串的欄位插入HTML與Script語言，造成其他正常使用者在觀看網頁的同時，瀏覽器會主動下載並執行部份惡意的程式碼，或被暗地裡導入到惡意 的網站，而受到某種型態的影響。如今大部份的網站都強調所謂與使用者互動的功能，加入許多允許使用者輸入字串的欄位，如：留言板、討論區、查詢欄位等；有 些互動的功能能將使用者輸入的字串存入後端資料庫，如果駭客輸入某些含有攻擊式的語言，一旦使用者進入此頁面時，因執行未預期的動作而將遭受某種程度的威 脅。
- 5月 13 週二 200814:23
[大砲開講]ZDNet台灣網站存在XSS安全漏洞
2008 年 05 月 13 日 – 09:38:00 ZDNet台灣網站被發現存在XSS(Cross-Site Scripting)安全漏洞，到目前為止，尚未修復。 跨站腳本攻擊(XSS)：駭客利用網站上允許使用者輸入 字元或字串的欄位插入HTML與Script語言，造成其他正常使用者在觀看網頁的同時，瀏覽器會主動下載並執行部份惡意的程式碼，或被暗地裡導入到惡意 的網站，而受到某種型態的影響。如今大部份的網站都強調所謂與使用者互動的功能，加入許多允許使用者輸入字串的欄位，如：留言板、討論區、查詢欄位等；有 些互動的功能能將使用者輸入的字串存入後端資料庫，如果駭客輸入某些含有攻擊式的語言，一旦使用者進入此頁面時，因執行未預期的動作而將遭受某種程度的威 脅。
- 5月 13 週二 200814:22
[大砲開講]精誠資訊CRM網站存在XSS安全漏洞
2008 年 05 月 13 日 – 09:34:01 精誠資訊CRM網站被XSSed發現存在XSS(Cross-Site Scripting)安全漏洞，到目前為止，尚未修復。
- 5月 13 週二 200814:21
[大砲開講]宏碁商用軟體網站存在XSS安全漏洞
2008 年 05 月 13 日 – 02:52:32 宏碁商用軟體網站被發現存在XSS(Cross-Site Scripting)安全漏洞，到目前為止，尚未修復。(Credit: 天罣) 跨站腳本攻擊(XSS)：駭客利用網站上允許使用者輸入 字元或字串的欄位插入HTML與Script語言，造成其他正常使用者在觀看網頁的同時，瀏覽器會主動下載並執行部份惡意的程式碼，或被暗地裡導入到惡意 的網站，而受到某種型態的影響。如今大部份的網站都強調所謂與使用者互動的功能，加入許多允許使用者輸入字串的欄位，如：留言板、討論區、查詢欄位等；有 些互動的功能能將使用者輸入的字串存入後端資料庫，如果駭客輸入某些含有攻擊式的語言，一旦使用者進入此頁面時，因執行未預期的動作而將遭受某種程度的威 脅。
