Alerts

Thunderbird v17.0 released

FYI...

Thunderbird v17.0 released
- https://www.mozilla.org/en-US/thunderbird/17.0/releasenotes
Nov 20, 2012

Automated Updates: https://support.mozillamessaging.com/en-US/kb/updating-thunderbird
Manual check: Go to >Help >About Thunderbird

Download
- https://www.mozilla.org/thunderbird/all.html

Security Advisories
- https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html#thunderbird17
___

- http://www.securitytracker.com/id/1027793
CVE Reference: CVE-2012-4201, CVE-2012-4202, CVE-2012-4204, CVE-2012-4205, CVE-2012-4207, CVE-2012-4208, CVE-2012-4209, CVE-2012-4212, CVE-2012-4213, CVE-2012-4214, CVE-2012-4215, CVE-2012-4216, CVE-2012-4217, CVE-2012-4218, CVE-2012-5829, CVE-2012-5830, CVE-2012-5833, CVE-2012-5835, CVE-2012-5836, CVE-2012-5838, CVE-2012-5839, CVE-2012-5840, CVE-2012-5841, CVE-2012-5842, CVE-2012-5843
Nov 21 2012
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Solution: The vendor has issued a fix (17.0)...

- https://secunia.com/advisories/51358/
Release Date: 2012-11-21
Criticality level: Highly critical
Impact: Security Bypass, Cross Site Scripting, System access
Where: From remote...
Solution: Upgrade to version 17.0.

:fear::fear:
 
Last edited:
Last edited:
WordPress Plugins - 464 Secunia Security Advisories ...

FYI...

"WordPress Plugin" search results ...
- https://secunia.com/advisories/search/?search=WordPress+Plugin
Found: 464 Secunia Security Advisories ...
Nov 27, 2012

>> http://piwik.org/blog/2012/11/secur...rver-hacked-for-a-few-hours-on-2012-nov-26th/
Updated: Nov 27, 2012 - "... The website Piwik.org is running WordPress and got compromised, because of a security issue in a WordPress plugin... compromised by an attacker on 2012 Nov 26th, this attacker added a malicious code in the Piwik 1.9.2 Zip file... You would be at risk only if you installed or updated to Piwik 1.9.2 on Nov 26th from 15:43 UTC to 23:59 UTC. If you are not using 1.9.2, or if you have updated to 1.9.2 earlier than Nov 26th 15:40 UTC or from Nov 27th, you should be safe..."
___

- http://h-online.com/-1757246
27 Nov 2012

:fear: :sad:
 
Last edited:
Java 0-Day exploit on sale for ‘Five Digits’

FYI...

Java 0-Day exploit on sale for ‘Five Digits’
- https://krebsonsecurity.com/2012/11/java-zero-day-exploit-on-sale-for-five-digits/
Nov 27, 2012 - "Miscreants in the cyber underground are selling an exploit for a previously undocumented security hole in Oracle’s Java software that attackers can use to remotely seize control over systems running the program... The flaw, currently being sold by an established member of an invite-only Underweb forum, targets an unpatched vulnerability in Java JRE 7 Update 9, the most recent version of Java (the seller says this flaw does not exist in Java 6 or earlier versions)... The seller was not terribly specific on the price he is asking for this exploit, but set the expected offer at “five digits.” The price of any exploit is ultimately whatever the market will bear, but this is roughly in line with the last Java zero-day exploit that was being traded and sold on the underground...
How to Unplug Java from the Browser:
> http://krebsonsecurity.com/how-to-unplug-java-from-the-browser/

:fear: :mad:
 
0-day vulns in MySQL fixed by MariaDB

FYI...

0-day vulns in MySQL fixed by MariaDB
- http://h-online.com/-1761451
3 Dec 2012 - "A recently published security vulnerability in the MySQL open source database has been met with fixes by the developers of the open source MariaDB* fork... they also note that a supposed zero day vulnerability that enumerates MySQL users has been known about for ten years. MariaDB versions 5.1, 5.2, 5.3 and 5.5, in which CVE 2012-5579 is fixed, are available for download*. MySQL provider Oracle has yet to confirm the vulnerabilities, much less provide updated software."
* http://downloads.mariadb.org/
___

- https://secunia.com/advisories/51427/
Release Date: 2012-12-03
... may be related to vulnerability #1: https://secunia.com/SA51008/
CVE Reference(s): CVE-2012-5611, CVE-2012-5612, CVE-2012-5614, CVE-2012-5615
Impact: Brute force, DoS, System access
Where: From local network
Software: MySQL 5.x
Solution: No official solution is currently available...
___

- http://blog.trendmicro.com/trendlab...ay-poc-exploits-threaten-oracle-mysql-server/
Dec 6, 2012 - "... MySQL Database is famous for its high performance, high reliability and ease of use. It runs on both Windows and many non-Windows platforms like UNIX, Mac OS, Solaris, IBM AIX, etc. It has been the fastest growing application and the choice of big companies such as Facebook, Google, and Adobe among others. Given its popularity, cybercriminals and other attackers are definitely eyeing this platform..."

:fear::fear:
 
Last edited:
cPanel - updates available

FYI...

cPanel - updates available
- https://secunia.com/advisories/51494/
Release Date: 2012-12-05
Criticality level: Moderately critical
Impact: Unknown
Where: From remote
Software: cPanel 11.x
... vulnerabilities are reported in versions prior to 11.30.7.4, 11.32.5.15, and 11.34.0.11.
Solution: Update to version 11.30.7.4, 11.32.5.15, or 11.34.0.11.
Original Advisory:
http://cpanel.net/important-security-release-cpanel-whm-11-30/
http://cpanel.net/important-11-32-security-update-cpanel-whm/
http://cpanel.net/important-11-34-security-release-cpanel-whm/

:fear::fear:
 
iTunes v11.0.1 released

FYI...

iTunes 11.0.1 released
- https://support.apple.com/kb/DL1614
Dec 13, 2012 - "This update to the new iTunes addresses an issue where new purchases in iCloud may not appear in your library if iTunes Match is turned on, makes iTunes more responsive when searching a large library, fixes a problem where the AirPlay button may not appear as expected, and adds the ability to display duplicate items within your library. This update also includes other important stability and performance improvements."

Available on Apple Software Update.

:fear:
 
iOS 6.0.2 Update ...

FYI...

iOS 6.0.2 Software Update
- http://support.apple.com/kb/DL1621
Dec 18, 2012 - Fixes a bug that could impact Wi-Fi...
System Requirements: iPhone 5, iPad mini

- http://www.todaysiphone.com/2012/12/ios-6-0-2-released-by-apple/
"... everyone and their dogs are trying to download the delta update and Apple’s servers are having a hard time..."

- http://bgr.com/2012/12/18/apple-releases-ios-6-0-2258170-258170/
Dec 18, 2012 - "... these Wi-Fi issues were supposed to be fixed with the release of iOS 6.0.1 but notes that users have still reported problems connecting to known Wi-Fi hotspots even after installing the patch..."

:fear::fear:
 
Shockwave - vulnerable Flash runtime

FYI...

Shockwave player - vulnerable Flash runtime
* http://www.kb.cert.org/vuls/id/323161
Last revised: 17 Dec 2012 - "Adobe Shockwave Player 11.6.8.638 and earlier versions on the Windows and Macintosh operating systems provide a vulnerable version of the Flash runtime..."

- http://h-online.com/-1772754
19 Dec 2012 - "US-CERT has warned that a security hole exists in Adobe's Shockwave Player*. Version 11.6.8.638 and earlier versions that were installed using the company's "Full" installer are affected. These all include an older version of Flash (10.2.159.1) that contains several exploitable vulnerabilities. Shockwave uses a custom Flash runtime instead of a globally installed Flash plugin. According to US-CERT, the Flash vulnerabilities can be exploited to execute arbitrary code at the user's privilege level via specially crafted Shockwave content. As the Shockwave Player tends to be used only rarely, simply uninstalling the software can provide protection. Adobe is even offering an uninstaller** for this purpose..."
** https://www.adobe.com/shockwave/download/alternates/
(See "Shockwave Player Uninstaller".)

- https://krebsonsecurity.com/2012/12/shocking-delay-in-fixing-adobe-shockwave-bug/
Dec 19, 2012 - "... U.S. CERT first warned Adobe about the vulnerability in October 2010, and Adobe says it won’t be fixing it until February 2013..."

- http://www.securitytracker.com/id/1027903
- http://www.securitytracker.com/id/1027904
- http://www.securitytracker.com/id/1027905
Dec 20 2012

- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6270 - 9.3 (HIGH)
- https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2012-6271 - 9.3 (HIGH)

:fear::fear: :blink:
 
Last edited:
FYI...

Thunderbird v17.0.2 released
- https://www.mozilla.org/en-US/thunderbird/17.0.2/releasenotes
Jan 8 2013

Automated Updates: https://support.mozillamessaging.com/en-US/kb/updating-thunderbird
Manual check: Go to >Help >About Thunderbird

Download
- https://www.mozilla.org/thunderbird/all.html

Security Advisories
- https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html#thunderbird17.0.2

- http://www.securitytracker.com/id/1027957
CVE Reference: CVE-2013-0743, CVE-2013-0744, CVE-2013-0745, CVE-2013-0746, CVE-2013-0747, CVE-2013-0748, CVE-2013-0749, CVE-2013-0750, CVE-2013-0752, CVE-2013-0753, CVE-2013-0754, CVE-2013-0755, CVE-2013-0756, CVE-2013-0757, CVE-2013-0758, CVE-2013-0759, CVE-2013-0760, CVE-2013-0761, CVE-2013-0762, CVE-2013-0763, CVE-2013-0764, CVE-2013-0766, CVE-2013-0767, CVE-2013-0768, CVE-2013-0769, CVE-2013-0770, CVE-2013-0771
Jan 9 2013
Impact: Disclosure of user information, Execution of arbitrary code via network, Modification of user information, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): prior to 17.0.2

:fear::fear:
 
WordPress v3.5.1 released

FYI...

WordPress v3.5.1 released
- https://wordpress.org/download/
"The latest stable release of WordPress (Version 3.5.1) is available..."

- https://wordpress.org/news/2013/01/wordpress-3-5-1/
Jan 24, 2013 - "... first maintenance release of 3.5, fixing 37 bugs... a security release for all previous WordPress versions..."

- https://secunia.com/advisories/51967/
Release Date: 2013-01-25
Criticality level: Moderately critical
Impact: Cross Site Scripting, Exposure of sensitive information
Where: From remote
... vulnerabilities are reported in versions prior to 3.5.1.
Solution: Update to version 3.5.1.
- http://www.securitytracker.com/id/1028045
Jan 25 2013
Impact: Disclosure of authentication information, Disclosure of user information, Execution of arbitrary code via network, Host/resource access via network, Modification of user information, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): prior to 3.5.1 ...

"WordPress Plugin" search results ...
- https://secunia.com/advisories/search/?search=WordPress+Plugin
Found -530- Secunia Security Advisories ...
March 14, 2013
___

- http://h-online.com/-1791820
25 Jan 2013
- http://www.h-online.com/imgs/43/9/7/5/0/2/1/wp3-5-1.jpg-e8882f4c597dc045.jpeg

:fear::fear:
 
Last edited:
UPnP advisory - US CERT

FYI...

UPnP advisory - US CERT
- https://www.us-cert.gov/current/#cert_releases_upnp_security_advisory
29 Jan 2013 - "Multiple vulnerabilities have been announced in libupnp, the open source portable SDK for UPnP devices. Libupnp is employed by hundreds of vendors for UPnP-enabled devices. Information is also available in CERT Vulnerability Note VU#922681*..."
* http://www.kb.cert.org/vuls/id/922681
29 Jan 2013 - "... Disable UPnP: Consider disabling UPnP on the device if it is not absolutely necessary..."
___

- https://community.rapid7.com/docs/DOC-2150
Jan 29, 2013 - "... We strongly recommend people to check whether they may be vulnerable, and if so, disable the UPnP protocol* in any affected devices..."
* https://community.rapid7.com/commun...s-in-universal-plug-and-play-unplug-dont-play
Jan 29, 2013 - "... Over 80 million unique IPs were identified that responded to UPnP discovery requests from the internet. Somewhere between 40 and 50 million IPs are vulnerable to at least one of three attacks.. In most cases, network equipment that is "no longer shipping" will not be updated at all, exposing these users to remote compromise until UPnP is disabled or the product is swapped for something new..."

> https://community.rapid7.com/servlet/JiveServlet/downloadImage/38-6031-2747/422-490/stats.png

UPnP Router Security Check: http://upnp-check.rapid7.com/
___

- http://atlas.arbor.net/briefs/index#-1299837074
Severity: High Severity
Jan 30, 2013
Universal Plug and Play provides a significant attack surface and should be protected from network access via robust access control protections on UDP port 1900 and/or hardened configuration.
Analysis: A large-scale scan of the Internet determined that a huge number of systems are vulnerable, and that exploitation in some cases can be performed with one UDP packet. This UDP packet can be spoofed. Actual attack details are not available to the public however we can rest assured that attackers are hard at work. While such bugs may not make their way into typical commodity crimeware exploit kits, targeted and opportunistic attackers with enough intelligence to create exploit code for these vulnerabilities are surely at work. One difficulty is that there are a large number of devices, each that may have their own specific configuration and device quirks that would require some research on the part of the attackers. The potential for a network-wide worm certainly exists. Organizations are encouraged to block uPnP as much as possible and ensure that attack surface is reduced because it is likely that the scanning activity will increase. While UDP port 1900 appears to the main vector, TCP/UDP port 2869 is also involved and should be monitored carefully and restricted as much as possible to reduce attack surface.
Source: http://arstechnica.com/security/2013/01/to-prevent-hacking-disable-universal-plug-and-play-now/

- http://h-online.com/-1794032
30 Jan 2013

:fear:
 
Last edited:
AdblockPlus v2.2.3 released

FYI...

Changelog for Adblock Plus 2.2.3
- https://adblockplus.org/releases/adblock-plus-223-for-firefox-released
Feb 13, 2013 - The following lists the changes compared to Adblock Plus 2.2.3. If you experience issues with this release please check the list of known issues.
• Worked around AVG Security Toolbar 14.0.3.* breaking Adblock Plus among other things.
• Made sure that first-run page always opens is the current browser window (bug 819561)...
___

AdblockPlus v2.2.2 released
- https://adblockplus.org/en/changelog-2.2.2
2013-01-30

- http://news.slashdot.org/story/13/01/31/238238/online-ads-are-more-dangerous-than-porn-cisco-says
Feb 01, 2013 - "The popular belief is that security risks increase as the user engages in riskier and shadier behavior online, but that apparently isn't the case, Cisco found in its 2013 Annual Security report*. It can be more dangerous to click on an online advertisement than an adult content site these days, according to Cisco. For example, users clicking on online ads were 182 times more likely to wind up getting infected with malware than if they'd surfed over to an adult content site, Cisco said. The highest concentration of online security targets do not target pornography, pharmaceutical, or gambling sites as much as they affect legitimate sites such as search engines, online retailers, and social media. Users are 21 times more likely to get hit with malware from online shopping sites and 27 more times likely with a search engine than if they'd gone to a counterfeit software site..."
* http://www.cisco.com/en/US/prod/vpndevc/annual_security_report.html

AdBlockPlus for Firefox: https://addons.mozilla.org/en-US/firefox/addon/adblock-plus/

> https://adblockplus.org/en/getting_started#install

:fear:
 
Last edited:
Expect a v2 of iOS 6.1 ...

FYI...

Expect a v2 of iOS 6.1 ...

iOS 6.1 Leads to Battery Life Drain, Overheating for iPhone Users
- http://thenextweb.com/apple/2013/02...verheating-issues-after-upgrading-to-ios-6-1/
8 Feb 2013

- http://arstechnica.com/apple/2013/0...-gives-anyone-access-to-your-contacts-photos/
Feb 14, 2013 - "An -old- vulnerability in the iPhone's lock screen and Emergency Call feature appears to have resurfaced for a third time in iOS 6.1. With the right sequence of button clicking, it's possible to get to an iPhone user's voicemails, contacts, and photos—even if the iPhone is locked and password protected..."
- https://secunia.com/advisories/52173/

Access restriction in iOS 6 partially useless
- http://h-online.com/-1805842
19 Feb 2013

Rapid growth in transaction logs, CPU use, and memory consumption in Exchange Server 2010 when a user syncs a mailbox by using an iOS 6.1-based device
- http://support.microsoft.com/kb/2814847
Last Review: February 12, 2013 - Revision: 5.0
Status: Apple and Microsoft are investigating this issue. We will post more information in this article when the information becomes available...
Workaround: To work around this issue, do not process Calendar items such as meeting requests on iOS 6.1 devices. Also, immediately restart the iOS 6.1 device...

:fear::fear:
 
Last edited:
iOS 6.1.2 Software Update

FYI...

iOS 6.1.2 Software Update
- https://support.apple.com/kb/DL1639
Feb 19, 2013 - "Fixes an Exchange calendar bug that could result in increased network activity and reduced battery life...
System Requirements: iPhone 3GS and later, iPad 2 and later, iPod touch 4th generation and later, iPhone 5 ..."

- http://support.microsoft.com/kb/2814847
Last Review: February 19, 2013 Revision: 15.0 - "... Resolution: Apple has posted the following article to address the issue:
- https://support.apple.com/kb/TS4532
Feb 19, 2013 - ... Resolution: To resolve this issue, update to iOS 6.1.2..."
___

iTunes 11.0.2 released
- https://support.apple.com/kb/DL1614
Feb 19, 2013

APPLE-SA-2013-02-19-1 Java for OS X 2013-001 and Mac OS X v10.6 Update 13
- http://prod.lists.apple.com/archives/security-announce/2013/Feb/msg00002.html
2013-02-19
- http://support.apple.com/kb/HT5666

:fear::fear:
 
Last edited:
Thunderbird 17.0.3 released

FYI...

Thunderbird 17.0.3 released
- https://www.mozilla.org/en-US/thunderbird/17.0.3/releasenotes
Feb 19, 2013

Automated Updates: https://support.mozillamessaging.com/en-US/kb/updating-thunderbird
Manual check: Go to >Help >About Thunderbird

Download
- https://www.mozilla.org/thunderbird/all.html

Security Advisories
- https://www.mozilla.org/security/known-vulnerabilities/thunderbird.html#thunderbird17.0.3

- http://www.securitytracker.com/id/1028165
CVE Reference: CVE-2013-0765, CVE-2013-0772, CVE-2013-0773, CVE-2013-0774, CVE-2013-0775, CVE-2013-0776, CVE-2013-0777, CVE-2013-0778, CVE-2013-0779, CVE-2013-0780, CVE-2013-0781, CVE-2013-0782, CVE-2013-0783, CVE-2013-0784
Feb 20 2013
Impact: Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, User access via network
Fix Available: Yes Vendor Confirmed: Yes
Version(s): prior to 17.0.3

:fear:
 
iOS/iTunes/Kindle app update...

FYI...

Amazon fixes its book deleting iTunes Kindle app update
- http://www.theinquirer.net/inquirer...es-its-book-deleting-itunes-kindle-app-update
Feb 28 2013 - "... Amazon has revisited the webpage and the update. Version 3.6.2* of the Kindle app for iOS includes both a fix for the registration issue and "Various Bug Fixes and Security Fixes"..."
* https://itunes.apple.com/us/app/kindle-read-books-ebooks-magazines/id302584613?mt=8
Updated: Feb 27, 2013
Version: 3.6.2
Size: 21.4 MB
What's New in Version 3.6.2
• Fix for Registration Issue
• Various Bug Fixes and Security Fixes...

:fear::sad:
 
Flash content in Safari...

FYI...

Apple blocks older insecure versions of Flash...
- https://isc.sans.edu/diary.html?storyid=15316
Last Updated: 2013-03-02 18:23:36 - "Apple has recently stepped up its response to security issues involving 3rd party plug-ins. They have aggressively used its anti-malware tool sets to enforce minimum versions of Adobe Flash*, Oracle Java, and similar popular plug-ins..."
* https://support.apple.com/kb/ht5655
Mar 1, 2013 - "... When attempting to view Flash content in Safari, you may see this alert: "Blocked Plug-in"
Selecting it will display this alert:
'Adobe Flash Player' is out of date.
- Click 'Download Flash…' to have Safari open the Adobe Flash Player installer website.
- Download the latest Adobe Flash Player installer--click the "Download now" button.
- Open the downloaded disk image.
- Open the installer and follow the onscreen instructions...'"

- https://support.apple.com/kb/HT5660
Mar 1, 2013

:fear::fear:
 
Last edited:
Apple Mac OS X update for Java

FYI...

APPLE-SA-2013-03-04-1: Apple Mac OS X update for Java
- https://secunia.com/advisories/52484/
Release Date: 2013-03-05
Criticality level: Highly critical
Impact: System access
Where: From remote
CVE Reference(s): CVE-2013-0809, CVE-2013-1493
For more information: https://secunia.com/SA52451/
Original Advisory: APPLE-SA-2013-03-04-1:
- http://support.apple.com/kb/HT5677
- http://prod.lists.apple.com/archives/security-announce/2013/Mar/index.html

- http://prod.lists.apple.com/archives/security-announce/2013/Mar/msg00000.html

:fear::fear:
 
You must log in or register to reply here.
Back
Top