jetlib.sec » Full Disclosure » February 13, 2012

Feeds

133098 items (0 unread) in 27 feeds

• 1337day (was: Inj3ct0r, 1337db)
• OSVDB Vulnerabilities
• Exploit-DB
• SecurityFocus Vulnerabilities
• Bugtraq
• Full Disclosure
• XSSed
• Packet Storm Security Headlines
• Packet Storm Security Advisories
• Packet Storm Security Exploits
• Packet Storm Security Recent Files
• Packet Storm Security Tools
• Packet Storm Security Misc. Files
• Sophos security news
• Sophos product advisories
• Penetration Testing
• SecuriTeam
• BackTrack Linux Forums
• Threatpost
• SecDocs
• carnal0wnage.attackresearch.com
• Carnal0wnage
• Kernel Fun
• Darknet
• The Exploitant
• Hack a Day
• Wirevolution

Full Disclosure

• February 13, 2012
• 

  [Netragard, Inc - Security Advisory] [Sonexis ConferenceManager Multiple Vulnerabilities]

  Posted: February 13th, 2012, 5:47pm PST

  Tags:   

  Posted by Netragard, Inc. - http://www.netragard.com on Feb 13

  Netragard Security Advisory - Sonexis ConferenceManager - 20120201
  
  [POSTING NOTICE]
  
  If you intend to post this advisory on your web page please create a
  link back
  to the original Netragard advisory as the contents of the advisory may
  change.
  
  For more information about Netragard visit:
  
  http://www.netragard.com
  
  [Advisory Information]
  
  Contact : sales () netragard com
  Advisory ID : NETRAGARD-20120201
  Researcher : Titon
  Product Name : Sonexis...
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 4:34pm PST

  Tags:   

  Posted by chris nelson on Feb 13

  dan,
  
  does the wash tool included with reaver check for advertised config
  methods? if not and it does some more in depth analysis to determine if an
  ap is vuln,, that might be the active scanner youre looking for.
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 4:33pm PST

  Tags:   

  Posted by Derek Grocke on Feb 13

  That's definitely not a good thing if it's found to be the case across more
  of the vendors.
  Is it the intent of the of the column on the google docs spreadsheet (WPS
  can be disabled and it stays off), to include confirmation of the retest
  after the WPS setting has been disabled?
  
  I wonder if everyone retested after the option was turned off? I hope so.
  
  Thanks
  Derek
  
  i believe that disabling wps on router still leaves some routers...
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 4:16pm PST

  Tags:   

  Posted by Dan Kaminsky on Feb 13

  Well, what this all tells me is that my process of simply checking for
  advertised configuration methods understates the number of nodes actually
  vulnerable. Reaver should be modifiable into an active scanner, at least.
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 4:09pm PST

  Tags:   

  Posted by Ian Hayes on Feb 13

  The Netgear N750 definitely does. I can rummage through my Box'o'Stuff
  and see if I have any more wireless APs...
  
  It looks like the Belkin routers don't. After disabling WPS, reaver
  just hung after hitting the channel the AP was on. Re-enabling, reaver
  went right to work.
  
  Just in case anyone hasn't figured out how to use it yet, I did an
  in-house presentation a few weeks ago:...
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 3:13pm PST

  Tags:   

  Posted by chris nelson on Feb 13

  also here: http://www.backtrack-linux.org/forums/showthread.php?t=47038 and
  here:
  http://adaywithtape.blogspot.com/2012/01/cracking-wpa-using-wps-vulnerability.html
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 3:09pm PST

  Tags:   

  Posted by chris nelson on Feb 13

  i believe that disabling wps on router still leaves some routers vulnerable
  was reported on before.
  from
  http://arstechnica.com/business/news/2012/01/hands-on-hacking-wifi-protected-setup-with-reaver.ars
  "Having demonstrated the insecurity of WPS, I went into the Linksys'
  administrative interface and turned WPS off. Then, I relaunched Reaver,
  figuring that surely setting the router to manual configuration would block
  the attacks at the...
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 2:23pm PST

  Tags:   

  Posted by Dan Kaminsky on Feb 13

  That's a fairly significant finding. Can anyone else confirm the existence
  of devices that still fall to Reaver even when WPS is disabled?
  
  Chris, when you run:
  
  iw scan wlan0 | grep “Config methods”
  
  Do you see a difference in advertised methods?
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 1:04pm PST

  Tags:   

  Posted by chris nelson on Feb 13

  i have tested reaver on a netgear and linksys (dont have model nos. with
  me) with wps disabled and enabled. the wps setting did not matter and both
  were vulnerable. was able to recover wpa2 passphrase in ~4 hrs on both.
  
• 

  fasmaes-1.0.tar.gz - An AES implementation for Flat Assembler (FASM)

  Posted: February 13th, 2012, 12:27pm PST

  Tags:   

  Posted by Levent Kayan on Feb 13

  yo was geht?
  
  DESCRIPTION
  ===========
  An AES-128, AES-192 and AES-256 implementation for FASM. Uses the the
  x86 32-bit instruction set and operates completely on the stack. No
  additional data segments are necessary which makes it easy to integrate
  the AES functions in any existing project.
  The implementation is not optimized for speed but for easy maintainability.
  
  File can be found at http://www.nullsecurity.net/tools.html
  
  cheers,
  noptrix
  
• 

  Attacking the Phishers: An Autopsy on Compromised Phishing Websites

  Posted: February 13th, 2012, 12:09pm PST

  Tags:   

  Posted by Adam Behnke on Feb 13

  InfoSec Institute researcher Quaker Doomer explores various phishing sites
  to see what the phishers are doing behind the scenes:
  
  http://resources.infosecinstitute.com/attacking-the-phishers/
  
• 

  Re: Arbitrary DDoS PoC

  Posted: February 13th, 2012, 11:15am PST

  Tags:   

  Posted by Sanguinarious Rose on Feb 13

  Ah what a wonderful gem of pure and real research into todays upcoming
  threats. Today is the day we learn to phear sites like xroxy.com
  because God forbid some of those silly kids using their 9001 proxies
  from their 56k dial-ups will over-run google, youtube, facebook, and
  the world! Dear God what will we do?!?!? When will it end! Think of
  the cute kittens you deprive us of evil proxy hackers!
  
  Today is the day I learned hackers can cast magick...
  
• 

  [SECURITY] [DSA 2408-1] php5 security update

  Posted: February 13th, 2012, 10:33am PST

  Tags:   

  Posted by Moritz Muehlenhoff on Feb 13

  -------------------------------------------------------------------------
  Debian Security Advisory DSA-2408-1 security () debian org
  http://www.debian.org/security/ Moritz Muehlenhoff
  February 13, 2012 http://www.debian.org/security/faq
  -------------------------------------------------------------------------
  
  Package : php5
  Vulnerability : several
  Problem type : remote...
  
• 

  Re: Arbitrary DDoS PoC

  Posted: February 13th, 2012, 8:38am PST

  Tags:   

  Posted by Gage Bystrom on Feb 13

  Absolutely and that's partly my point. The methods you describe are neigh
  exactly how modern general ddos techniques work, which is not how this
  works.
  
  One problem is you can't use Facebook or Google as an open proxy like
  you're saying because 1.) It assumes you can force Google or Facebook to
  make multiple requests for just one of your requests, else you are still
  being stuck to how much you can output vs how much they can take....
  
• 

  Re: Trustwave and Mozilla

  Posted: February 13th, 2012, 8:37am PST

  Tags:   

  Posted by Nick Boyce on Feb 13

  OT: that problem was actually caused by having XSLT disabled in NoScript
  options on the WinXP box - sorry for the misdirection.
  
  Nick
  
• 

  Re: Trustwave and Mozilla

  Posted: February 13th, 2012, 8:19am PST

  Tags:   

  Posted by Nick Boyce on Feb 13

  https://www.infoworld.com/d/security/trustwave-admits-issuing-man-in-the-middle-digital-certificate-185972
  
  Can anyone confirm that Trustwave CA certificates in the local Mozilla
  certificate store are the ones with names containing the word "SecureTrust"
  ?
  
  I want to disable Trustwave CAs on all my local systems, but am not certain
  which are the relevant ones. For some benighted reason, the word
  "Trustwave" is not present in...
  
• 

  Re: Vulnerability in Novell website.

  Posted: February 13th, 2012, 8:08am PST

  Tags:   

  Posted by Marcus Meissner on Feb 13

  Hi,
  
  We have escalated this within Novell and the CRS servlet got removed
  last week on the day of the report.
  
  Ciao, Marcus
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 7:32am PST

  Tags:   

  Posted by Dan Kaminsky on Feb 13

  Have you directly confirmed a WPS exchange can occur even on devices that
  aren't advertising support? That would indeed be a quick and dirty way to
  "turn the feature off".
  
• 

  [ MDVSA-2012:018 ] mozilla-thunderbird

  Posted: February 13th, 2012, 7:09am PST

  Tags:   

  Posted by security on Feb 13

  _______________________________________________________________________
  
  Mandriva Linux Security Advisory MDVSA-2012:018
  http://www.mandriva.com/security/
  _______________________________________________________________________
  
  Package : mozilla-thunderbird
  Date : February 13, 2012
  Affected: 2011.
  _______________________________________________________________________
  
  Problem Description:
  
  Use-after-free...
  
• 

  Re: Arbitrary DDoS PoC

  Posted: February 13th, 2012, 5:49am PST

  Tags:   

  Posted by adam on Feb 13

  I have to admit that I've only read the posts here, haven't actually
  followed the link, but in response to Gage:
  
  It entirely depends on how it's being done, specifically: what
  services/applications are being targeted and in what way. If he's proxying
  through "big" servers such as those owned by Facebook, Google, Wikipedia,
  etc: then it definitely does make a difference. You're assuming that his
  network speed...
  
• 

  Re: Skype v. 5.x.x - information disclosure

  Posted: February 13th, 2012, 5:22am PST

  Tags:   

  Posted by Mario Vilas on Feb 13

  Good find. I think it should also be possible to disable the "delete
  *" command with triggers, as a nice way to backdoor the database
  (almost non intrusive compared with installing rogue plugins, and the
  user isn't likely to ever find out).
  
• 

  Re: Arbitrary DDoS PoC

  Posted: February 13th, 2012, 5:17am PST

  Tags:   

  Posted by Gage Bystrom on Feb 13

  Uhh...looks pretty standard boss. You aren't going to DoS a halfway decent
  server with that using a single box. Sending your request through multiple
  proxies does not magically increase the resource usage of the target, its
  still your output power vs their input pipe. Sure it gives a slight boost
  in anonymity and obfuscation but does not actually increase effectiveness.
  It would even decrease effectiveness because you bear the burden of...
  
• 

  Re: Trustwave and Mozilla

  Posted: February 13th, 2012, 5:12am PST

  Tags:   

  Posted by decoder on Feb 13

  Hi Jeffrey,
  
  Please take a look at our security roadmap (
  https://wiki.mozilla.org/Security/Roadmap ). You will see that CA
  pinning is a P1 Feature which means it is actively being worked on. In
  fact our update service does already some sort of pinning (for securely
  retrieving updates), it's just that failures are not reported right now.
  It's possible that this sort of pinning could be extended to other
  services and also alert the user...
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 4:40am PST

  Tags:   

  Posted by William Warren on Feb 13

  actually you only need to uges the first 4 then it's child's play.
  Tools that are out now guess this in seconds not years. wps is a total
  failure by its very design.
  http://twit.tv/show/security-now/337
  Steve while he's often derided goes into this very well. Many cisco's
  only stop advertising wps when it is "off" but wps actually still
  exists...which means they are still easily hackable.
  
• 

  Skype v. 5.x.x - information disclosure

  Posted: February 13th, 2012, 4:38am PST

  Tags:   

  Posted by Osama Bin Error on Feb 13

  Title:
  ======
  Skype v. 5.x.x - information disclosure
  
  Date:
  =====
  2012-02-13
  
  Introduction:
  =============
  Skype is a proprietary voice-over-Internet Protocol service and
  software application.
  
  Abstract:
  =========
  We have discovered improper chat logs handling, which cause in logs
  accessibility even if user had enabled "no history" option in "Keep
  history for" settings or even destroy it manually with "Clear history"...
  
• 

  XSS vulnerability in WEIBO.COM

  Posted: February 13th, 2012, 4:37am PST

  Tags:   

  Posted by Yuping Li on Feb 13

  Information
  ---------------------------------
  Name : XSS Vulnerability in WEIBO.COM
  Vendor Homepage : http://corp.sina.com.cn/eng/sina_index_eng.htm
  Vulnerability Type : Cross-Site Scripting
  Severity : High
  Researcher : Yuping Li at ADLab of Beijing Leadsec Technology Co., Ltd
  
  Description
  ---------------------------------
  WEIBO.COM is the largest twitter-like website in China, which claimed to
  have more than 200 million users in 2011. It...
  
• 

  Arbitrary DDoS PoC

  Posted: February 13th, 2012, 4:35am PST

  Tags:   

  Posted by Lucas Fernando Amorim on Feb 13

  With the recent wave of DDoS, a concern that was not taken is the model
  where the zombies were not compromised by a Trojan. In the standard
  modeling of DDoS attack, the machines are purchased, usually in a VPS,
  or are obtained through Trojans, thus forming a botnet. But the
  arbitrary shape doesn't need acquire a collection of computers.
  Programs, servers and protocols are used to arbitrarily make requests on
  the target. P2P programs...
  
• 

  EditWRX CMS Remote Code Execution + Admin Bypass Zero Day

  Posted: February 13th, 2012, 4:30am PST

  Tags:   

  Posted by chippy on Feb 13

  __ __ ____ ______ ______ ______
  .----.| |--.|__|.-----.-----.--.--.|_ | |__ |__ | |
  | __|| || || _ | _ | | | _| |_|__ |__ |_ |
  |____||__|__||__|| __| __|___ ||______|______|______| |____|
  _________________|__|__|__|__|_____|_____________________________
  
  VULN_____________________________________________________________
  EditWRX CMS Remote Code Execution + Admin Bypass...
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 4:29am PST

  Tags:   

  Posted by Alex Buie on Feb 13

  Just morbidly curious, what did you use for the SSID?
  
• 

  Re: Linksys Routers still Vulnerable to Wps vulnerability.

  Posted: February 13th, 2012, 4:18am PST

  Tags:   

  Posted by Derek on Feb 13

  secure_CC_POS
  
  Thanks
  Derek
  
• 

  [TEHTRI-Security] 0days at HITB Amsterdam 2012

  Posted: February 13th, 2012, 3:00am PST

  Tags:   

  Posted by Laurent OUDOT at TEHTRI-Security on Feb 13

  Dear contacts,
  
  During the next "Hack In The Box" event in Amsterdam (22nd & 23rd May
  2012), TEHTRI-Security will come again, and propose an updated training
  called *Hunting Web Attackers* with offensive cyber weapons shared with
  our students.
  
  For example, during the final live hacking exercise, we will show how to
  strike-back against a team of attackers, thanks to multiple kind of
  0days (hacking: web applications + client-side +...