FreeBSD Security Advisory – Kernel Memory Disclosure / Corruption

FreeBSD Security Advisory – SCTP protocol provides reliable, flow-controlled, two-way transmission of data. It is a message oriented protocol and can support the SOCK_STREAM and SOCK_SEQPACKET abstractions. SCTP allows the user to choose between multiple scheduling algorithms to optimize the sending behavior of SCTP in scenarios with different requirements. Due to insufficient validation of the SCTP stream ID, which serves as an array index, a local unprivileged attacker can read or write 16-bits of kernel memory.

Now we are simplexity!

Making complex things simple. That’s the meaning of simplexity, and the basis of the transformation Panda has undergone.

An internal and external transformation of the way we do things, and which signals the beginning of an ambitious five-year strategic plan based on growth, technology and international expansion.

This is the new Panda

panda logo

Our new corporate identity coincides with the company’s 25th anniversary and is the result of the participation of all Panda’s offices around the world.

The worldwide presentation of our new strategic plan took place yesterday in Madrid. This event, which was attended by numerous Panda employees as well as the media, gave us the opportunity to explain the company’s core values among many other things: non-conformist, people-centric and innovative.

Here are some pictures from the event!

panda security simplexity

 

diego navarrete panda security

Diego Navarrete, Panda Security CEO, during the event

 

Paula Quiros Panda Security

Paula Quirós, our CMO

 

Felipe Mejias Panda Security

#PandaSimplexity by Felipe Mejías

 

simplexity panda security

After almost a year of hard work we are finally proud to present to you the new Panda. What do you think? Will you join #PandaSimplexity?

The post Now we are simplexity! appeared first on MediaCenter Panda Security.

SA-CONTRIB-2015-031 – GD Infinite Scroll – Multiple vulnerabilites

Description

GD Infinite Scroll module enables you to use the “infinite scroll jQuery plugin : auto-pager” on custom pages.

Some links were not protected against CSRF. A malicious user could cause another user with the “edit gd infinite scroll settings” permission to delete settings by getting his browser to make a request to a specially-crafted URL.

Also, the module fails to sanitize user input in its admin page, leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission “edit gd infinite scroll settings”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

All GD Infinite Scroll versions prior to 7.x-1.4

Drupal core is not affected. If you do not use the contributed GD Infinite Scroll module,
there is nothing you need to do.

Solution

Install the latest version, upgrade to GD Infinite Scroll 7.x-1.4

Also see the GD Infinite Scroll project page.

Reported by

  • Pere Orga provisional member of the Drupal Security Team

Fixed by

Coordinated by

  • Pere Orga provisional member of the Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

SA-CONTRIB-2015-030 – Amazon AWS – Access bypass

Description

Amazon AWS module provides integration with Amazon Web Services (AWS).

A malicious user could potentially guess an access token and trigger the creation of new backups by making a request to a specially-crafted URL. If the number of stored backups was limited, an attacker could exceed the limit by calling the URL multiple times, thereby resulting in the loss of older backup states that would get replaced with the newly generated ones.

This vulnerability is mitigated by the fact that an attacker must know the AWS Access Key Id (these are not secret).

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Amazon AWS versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Amazon AWS module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Amazon AWS project page.

Reported by

  • Pere Orga provisional member of the Drupal Security Team

Fixed by

Coordinated by

  • Pere Orga provisional member of the Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Online privacy protection in the EU

It’s European #‎DataProtection day! Every day we visit websites and willingly hand over our name, address, and credit card number. Have you ever thought about what happens to that data or what your rights are?

European ‪#‎DataProtection‬ day

Avast keeps your personal data private.

 

Members of the European Union (EU) enjoy a high standard of protection of their personal data. The Digital Agenda for Europe lays it all out for you on their website. Here’s a summary:

The burden to protect you is on organizations

The EU Data Protection Directive ensures that personal data can only be gathered under strict conditions and for legitimate purposes. Organizations that collect and manage your personal information must also protect it from misuse and respect certain rights. One of the objectives is that organizations notify their customers, in plain language, what information is collected and how it is used as well as get permission before using any personal information.

One of the stumbling blocks has been the so-called one-stop-shop for businesses and citizens in each member state in which authorities will handle citizens’ complaints about any breach of the rules. There are just as many ideas on how to run it as there are EU member states.

You must be notified of cookies and data breaches

The Directive on Privacy and Electronic communications (ePrivacy Directive) ensures that all communications over public networks maintain a high level of privacy. For example, this directive requires website owners marketing online to EU citizens to obtain consent from users, via some kind of opt-in, before implementing cookies or other technologies to capture online visitor information. (See below for information on managing your cookies.)

If your data is stolen, the ePrivacy Directive states that you should be notified. That’s good because data theft can result in identity theft or fraud, damage to your reputation, loss of control over your personal data or a loss of confidentiality.

However, this fall, the rules changed slightly and now businesses don’t have to notify consumers that their personal data has been lost or stolen if the data has been encrypted. The ministers figure that the business has “appropriate technological protection measures” to protect the data that has been lost or stolen from being accessed by people not authorized to see it.

Viewing and managing your cookies

For those of you not familiar with the term, cookies are small files stored in your browser that contain information about your visit to a web page. They help tailor your online shopping experiences by doing things such as recording items in your shopping cart, they also recommend products based on your interests, allow auto-log in and compile browsing histories.

In most modern browsers, you can control cookie settings. The options include viewing stored cookies, controlling which sites you accept cookies from, and setting how long they may be stored and used.

Chrome

  1. 1. Open the drop-down menu in the top right corner of the Chrome browser, select Settings.
  2. 2. At the bottom of the page, click Show advanced settings.
  3. 3. In the Privacy section, open the button that says Content settings.
  4. 4. Under Cookies, you check or uncheck the options to manage the settings.
  5. 5. To see individual cookies, click All cookies and site data.
  6. 6. To remove cookies, hover the mouse over the entry. Click the X to delete.
  7. 7. To delete all cookies, click Remove all.

Firefox

For instructions to clear cookies in Firefox, please visit Mozilla’s support page.

Chrome

For instructions on clearing and managing cookies in Internet Explorer, please search Microsoft help for your version of IE. Here’s general information.