< Back to JetLib.com

jetlib.sec » Tags » security-bulletins

« Expand/Collapse

25 items tagged "security bulletins"

Related tags: microsoft security bulletin advance notification [+], microsoft security bulletin [+], security [+], microsoft [+], advance [+], xml [+], password properties [+], external entity [+], coldfusion [+], adobe [+]

May 03, 2012
16:16
Microsoft Security Bulletin Advance Notification For May, 2012
» ‎ Packet Storm Security Advisories

This is an advance notification of 7 security bulletins that Microsoft is intending to release on May 8, 2012.
Tags: microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

16:16
Microsoft Security Bulletin Advance Notification For May, 2012
» ‎ Packet Storm Security Recent Files

This is an advance notification of 7 security bulletins that Microsoft is intending to release on May 8, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

16:16
Microsoft Security Bulletin Advance Notification For May, 2012
» ‎ Packet Storm Security Misc. Files

This is an advance notification of 7 security bulletins that Microsoft is intending to release on May 8, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

April 05, 2012
19:00
Microsoft Security Bulletin Advance Notification For April 2012
» ‎ Packet Storm Security Advisories

This is an advance notification of security bulletins that Microsoft is intending to release on April 10, 2012.
Tags: microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

19:00
Microsoft Security Bulletin Advance Notification For April 2012
» ‎ Packet Storm Security Recent Files

This is an advance notification of security bulletins that Microsoft is intending to release on April 10, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

19:00
Microsoft Security Bulletin Advance Notification For April 2012
» ‎ Packet Storm Security Misc. Files

This is an advance notification of security bulletins that Microsoft is intending to release on April 10, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

March 08, 2012
21:25
Microsoft Security Bulletin Advance Notification For March 2012
» ‎ Packet Storm Security Advisories

This is an advance notification of security bulletins that Microsoft is intending to release on March 13, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

21:25
Microsoft Security Bulletin Advance Notification For March 2012
» ‎ Packet Storm Security Recent Files

This is an advance notification of security bulletins that Microsoft is intending to release on March 13, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

21:25
Microsoft Security Bulletin Advance Notification For March 2012
» ‎ Packet Storm Security Misc. Files

This is an advance notification of security bulletins that Microsoft is intending to release on March 13, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

February 10, 2012
22:16
Microsoft Security Bulletin Advance Notification For February 2012
» ‎ Packet Storm Security Advisories

This is an advance notification of 9 security bulletins that Microsoft is intending to release on February 14, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

22:16
Microsoft Security Bulletin Advance Notification For February 2012
» ‎ Packet Storm Security Recent Files

This is an advance notification of 9 security bulletins that Microsoft is intending to release on February 14, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

22:16
Microsoft Security Bulletin Advance Notification For February 2012
» ‎ Packet Storm Security Misc. Files

This is an advance notification of 9 security bulletins that Microsoft is intending to release on February 14, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

January 09, 2012
12:46
Microsoft Security Bulletin Advance Notification For January 2012
» ‎ Packet Storm Security Advisories

This is an advance notification of 7 security bulletins that Microsoft is intending to release on January 10, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

12:46
Microsoft Security Bulletin Advance Notification For January 2012
» ‎ Packet Storm Security Recent Files

This is an advance notification of 7 security bulletins that Microsoft is intending to release on January 10, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

12:46
Microsoft Security Bulletin Advance Notification For January 2012
» ‎ Packet Storm Security Misc. Files

This is an advance notification of 7 security bulletins that Microsoft is intending to release on January 10, 2012.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

December 08, 2011
16:38
Microsoft Security Bulletin Advance Notification For December 2012
» ‎ Packet Storm Security Advisories

This is an advance notification of 14 security bulletins that Microsoft is intending to release on December 13th, 2011.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

16:38
Microsoft Security Bulletin Advance Notification For December 2012
» ‎ Packet Storm Security Recent Files

This is an advance notification of 14 security bulletins that Microsoft is intending to release on December 13th, 2011.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

16:38
Microsoft Security Bulletin Advance Notification For December 2012
» ‎ Packet Storm Security Misc. Files

This is an advance notification of 14 security bulletins that Microsoft is intending to release on December 13th, 2011.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

November 03, 2011
15:16
Microsoft Security Bulletin Advance Notification For November 2011
» ‎ Packet Storm Security Advisories

This is an advance notification of 4 security bulletins that Microsoft is intending to release on November 8th, 2011.
Tags: microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

15:16
Microsoft Security Bulletin Advance Notification For November 2011
» ‎ Packet Storm Security Recent Files

This is an advance notification of 4 security bulletins that Microsoft is intending to release on November 8th, 2011.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

15:16
Microsoft Security Bulletin Advance Notification For November 2011
» ‎ Packet Storm Security Misc. Files

This is an advance notification of 4 security bulletins that Microsoft is intending to release on November 8th, 2011.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

October 06, 2011
13:21
Microsoft Security Bulletin Advance Notification For October 2011
» ‎ Packet Storm Security Advisories

This is an advance notification of 8 security bulletins that Microsoft is intending to release on October 11, 2011.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

13:21
Microsoft Security Bulletin Advance Notification For October 2011
» ‎ Packet Storm Security Recent Files

This is an advance notification of 8 security bulletins that Microsoft is intending to release on October 11, 2011.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

13:21
Microsoft Security Bulletin Advance Notification For October 2011
» ‎ Packet Storm Security Misc. Files

This is an advance notification of 8 security bulletins that Microsoft is intending to release on October 11, 2011.
Tags: advance microsoft security microsoft-security-bulletin-advance-notification microsoft-security-bulletin security-bulletins

November 06, 2010
5:57
Adobe XML Injection Metasploit Module
» ‎ Carnal0wnage

I just pushed out code coverage for the Adobe XML External Entity Injection vulnerability in multiple adobe products including: BlazeDS 3.2 and earlier versions, LiveCycle 9.0, 8.2.1, and
8.0.1, LiveCycle Data Services 3.0, 2.6.1, and 2.5.1, Flex Data
Services 2.0.1, ColdFusion 9.0, 8.0.1, 8.0, and 7.0.2

References Here:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=2009-3960
http://www.osvdb.org/62292
http://www.securityfocus.com/bid/38197
http://www.security-assessment.com/files/advisories/2010-02-22_Multiple_Adobe_Products-XML_External_Entity_and_XML_Injection.pdf
http://www.adobe.com/support/security/bulletins/apsb10-05.html

I recommend you read security-asessment's pdf on it, its good.

Anyway, its a cool bug.
1 -->because it affects several products although most people have probably never heard of most of them except for ColdFusion.
2 -->its enabled by default on all those products you've never heard of except for ColdFusion, with the exception of CF 8 which appears to have it turned on by default.
3 -->You have to apply patches for CF individually and there is no automated process. Since this vuln got little media attention I've seen alot of hosts that are still missing this patch and/or didn't turn off the vuln service.

On with the demo!

So against a patched host or someone that has disabled the service in ColdFusion you'll see one of two things; either 404's for the checks or 200 for /flex2gateway/ and 500 for the http or https check.

If you get a bunch of 400's then you need to set the VHOST

When it works, you'll see something like this for /etc/passwd

and like this when you asked for a file that doesn't exist or doesn't have permission to read (since CF doesn't run as root on linux, requesting /etc/shadow wont work) :-(

At this point, you're probably like "so what" well whats cool about arbitrary file read is that 1. it also works on Windows:

and 2. that whole password.properties attack is now cool again because you can just request that file too

-CG
Tags: xml coldfusion adobe password-properties security-bulletins external-entity