News aggregator

Vuln: DotNetNuke User Account Security Bypass Vulnerability

Vulnerabilities - Thu, 24/12/2009 - 05:00
DotNetNuke User Account Security Bypass Vulnerability

Bogus LinkedIn Profiles Harbor Malicious Content

Secguru RSS Feed - 3 hours 44 min ago

The LinkedIn professional networking site connects more than 30 million users from across many different industries. The advantages of maintaining a list of trusted business contacts for career planning purposes is not lost on LinkedIn’s users.

The fostering of business relationships is further enhanced by features such as LinkedIn Answers and access from mobile devices.

Advanced Threats Researcher Ivan Macalintal found some bogus LinkedIn profiles which contain links to malware, using the names and images of famous personalities.

Bugtraq: [USN-702-1] Samba vulnerability

Vulnerabilities - 10 hours 46 min ago
[USN-702-1] Samba vulnerability

Bugtraq: Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏

Vulnerabilities - 10 hours 46 min ago
Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏

Bugtraq: Walusoft TFTPServer2000 Version 3.6.1 Directory Traversal

Vulnerabilities - 10 hours 46 min ago
Walusoft TFTPServer2000 Version 3.6.1 Directory Traversal

Bugtraq: Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏

Vulnerabilities - 10 hours 46 min ago
Re: php 4.x php5.2.x all "show_source()" ,"highlight_file()" bypass‏

Vuln: Microsoft MSN Messenger IP Address Information Disclosure Vulnerability

Vulnerabilities - Mon, 05/01/2009 - 05:00
Microsoft MSN Messenger IP Address Information Disclosure Vulnerability

Vuln: E-topbiz Online Store 'login.php' SQL Injection Vulnerability

Vulnerabilities - Mon, 05/01/2009 - 05:00
E-topbiz Online Store 'login.php' SQL Injection Vulnerability

Vuln: E-topbiz eStore 'index.php' SQL Injection Vulnerability

Vulnerabilities - Mon, 05/01/2009 - 05:00
E-topbiz eStore 'index.php' SQL Injection Vulnerability

PriceWaterhouseCooper wrestles with Satyam dilemma

Secguru RSS Feed - Mon, 05/01/2009 - 00:37

The statutory auditor for Satyam Computer Services, PricewaterhouseCoopers (PwC), may review its “continuance” with the troubled software firm. The company’s image has been tarnished after its scuppered bid to buy two firms linked to its promoter B Ramalinga Raju.

“We do re-visit the process acceptance and continuance, whenever there are any major developments. We have been statutory auditors for the company for at least six years now. But we need to assess whether our judgement (on the company) continues to hold good. A re-evaluation is in sync with international norms on auditing,” said a source privy to the developments at PwC, who wished not to be named.

However, when contacted PwC’s spokesperson said: “As auditors, we are not allowed to comment on audit clients due to client confidentiality.” The source quoted earlier did not categorically say that the relationship would be reviewed, but said such a review was a possibility given what had happened.

In the normal course, the board (of any company) has to recommend the auditors’ appointment at the time of finalisation of accounts. The auditors, in turn, give their concurrence (continuance is industry jargon for this) in case they wish to come on the board or continue with the contract. The appointment is then ratified by shareholders at the company’s annual general meeting.

“The Satyam case relates to a risk on the company’s reputation, as investors questioned the propriety of buying two firms run by Ramalinga Raju’s sons. So a review on continuance of the auditing relationship appears possible,” said the source.

The board had on December 16 passed an unanimous resolution to allow Satyam buy Maytas Infra and Maytas Properties for $1.6 billion. But the deal was called off in the wake of an outrage from the company’s shareholders as well as the institutional investors.

Tech Jobs May Increase Despite Economic Trends

Secguru RSS Feed - Mon, 05/01/2009 - 00:31

The outlook for IT jobs in 2009 may not be as bad as some observers suggest. While some indicators and surveys are showing some declines in tech jobs, none predict a precipitous drop. In fact, a federal economic stimulus package may even add IT positions.

"IT jobs are relatively safe in the aftermath of the economic meltdown compared to jobs in general," said David Foote of Vero Beach Fla.-based Foote Partners LLC , which analyzes IT wages and hiring data.

While 853,000 U.S. jobs in all industries were lost in October and November, 9,000 were gained in the U.S. Bureau of Labor Statistics categories of "Computer Systems Design and Related Services" and "Management and Technical Consulting Services," said Foote.

The IT job market is stable, said Foote, "because a lot has happened to show businesses that IT is really our edge."

How to Succeed in Tech in a Downturn

Secguru RSS Feed - Mon, 05/01/2009 - 00:30

The economy is in trouble -- everywhere. Even outsourced providers are nervous. Already under stress, IT staffers see their jobs getting more and more difficult as they must do more with less, all while wondering if they'll keep their jobs at all.

That's why you need a plan for your tech career. The worst thing you can do is give up or panic. Although tech jobs are under increasing pressure, the reality is that the technology jobs market overall is still doing better than the market for other types of jobs. That doesn't mean you're immune from layoffs, stagnant salaries, or increasing workloads, but it does mean you have more options than many other workers -- if you're willing to be flexible.

14% of SSL certificates on the Internet potentially unsafe

Secguru RSS Feed - Mon, 05/01/2009 - 00:28

Netcraft provided more details on a critical digital certificate vulnerability revealed last week. Although Microsoft downplayed the problem by stating that the successful exploit was not published, Netcraft found that 14% of SSL certificates use the vulnerable MD5 hashing algorithm. That number may provide a large enough target for attackers to invest time into cracking MD5, while certificate authorities will have a choice of using MD5 and hope that it will not be cracked or transitioning to a stronger encryption technology such as SHA-1.

A digital certificate is what we typically rely on as evidence for a secure encryption to another website. Especially when we want connection to be protected, for example during money transactions and online banking, these certificates provide proof that we are in fact dealing with an intended website and not, for example, a phishing attack. However, that may no longer be the case as researchers demonstrated last week that it is possible to create to create a rogue certification authority (CA) that is “trusted by all major web browsers and a cluster of more than 200 commercially available game consoles” by using an advanced implementation of a strategy called collision attack.

Microsoft made $1.5B on 'Vista Capable' campaign

Secguru RSS Feed - Mon, 05/01/2009 - 00:27

Microsoft Corp. earned more than $1.5 billion from the sale of PCs marked as "Vista Capable" in the months leading up to the 2007 debut of Windows Vista, according to an expert's estimate.

University of Washington economist Dr. Keith Leffler pegged Microsoft's income from sales of Windows XP licenses on Vista Capable-labeled computers at $1.505 billion. Leffler has testified for the plaintiffs in the ongoing class-action lawsuit that accuses Microsoft of deceiving consumers during its Vista Capable marketing program. The company created the program to maintain PC sales momentum as the launch of Vista neared.

Bugtraq: Re: Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service exploit

Vulnerabilities - Mon, 05/01/2009 - 00:00
Re: Linux Kernel 2.6.18/2.6.24/2.6.20/2.6.22/2.6.21 denial of service exploit

Bugtraq: [SECURITY] [DSA 1695-1] New Ruby packages fix denial of service

Vulnerabilities - Mon, 05/01/2009 - 00:00
[SECURITY] [DSA 1695-1] New Ruby packages fix denial of service

Bugtraq: [SECURITY] [DSA 1694-1] New xterm packages fix remote code execution

Vulnerabilities - Mon, 05/01/2009 - 00:00
[SECURITY] [DSA 1694-1] New xterm packages fix remote code execution
Syndicate content