Mandriva Linux Security Advisory 2015-181 – Updated drupal packages fix multiple security vulnerabilities.
Monthly Archives: March 2015
Mandriva Linux Security Advisory 2015-177
Mandriva Linux Security Advisory 2015-177 – ctdb before 2.5 is vulnerable to symlink attacks to due the use of predictable filenames in /tmp, such as /tmp/ctdb.socket.
Mandriva Linux Security Advisory 2015-029-1
Mandriva Linux Security Advisory 2015-029 – Multiple integer overflows in the _objalloc_alloc function in objalloc.c and objalloc_alloc macro in include/objalloc.h in GNU libiberty, as used by binutils 2.22, allow remote attackers to cause a denial of service via vectors related to the addition of CHUNK_HEADER_SIZE to the length, which triggers a heap-based buffer overflow. Various other issues have also been addressed. The updated packages provide a solution for these security issues.
Mandriva Linux Security Advisory 2015-175
Mandriva Linux Security Advisory 2015-175 – A flaw was discovered in ejabberd that allows clients to connect with an unencrypted connection even if starttls_required is set.
Mandriva Linux Security Advisory 2015-176
Mandriva Linux Security Advisory 2015-176 – Updated dbus packages fix multiple security vulnerabilities.
Mandriva Linux Security Advisory 2015-174
Mandriva Linux Security Advisory 2015-174 – An FTP command injection flaw was found in Erlang’s FTP module. Several functions in the FTP module do not properly sanitize the input before passing it into a control socket. A local attacker can use this flaw to execute arbitrary FTP commands on a system that uses this module. This update also disables SSLv3 by default to mitigate the POODLE issue.
MongoDB Patches Remote Denial-of-Service Vulnerability
Popular NoSQL database MongoDB has released an update that patches a critical denial-of-service vulnerability.
Vulnerability found in Trivia Crack
Earlier in March, researcher Randy Westergren, decided to investigate the gameplay mechanics of popular trivia quiz app Trivia Crack.
What he found was surprising. Within the app’s code is a hidden “cheat mode” that provides the player with the answers to each question, clearly not intended for general use.
While discovering “cheat mode” doesn’t present an immediate threat to most players, it’s a timely reminder that not all apps are secure.
Westergren altered the Trivia Crack’s code to harmlessly enable “cheat mode” but it is also possible to insert malicious code.
As Westergren explains, this vulnerability “should serve as a good example that client application privacy cannot be guaranteed and developers should be careful about what’s included in their compiled releases.”
Trivia Crack is certainly not the first popular app to face scrutiny from potential attackers with apps such as Angry Birds often the target for malicious attack.
As AVG CTO Yuval Ben-Itzhak explained in his recent blog post, “hackers are clever; they have found ways to get around stringent app store controls by exploiting existing non-malicious apps that are vulnerable.”
The largest challenge for mobile security today is not blocking malicious apps but instead protecting benign apps that are vulnerable to attack thanks to short time to market, small development teams and budgets.
Even apps from well-known developers or apps that you have had installed for a long time can become vulnerable if not properly maintained and security tested.
How can players protect themselves?
The best way to defend yourself against malicious apps is to download mobile antivirus on your device.
AVG AntiVirus for Android FREE has over 100 million downloads from the Google Play Store.
Watch this video for more tips to help you protect your Android device,
Video
How to protect your Android device
CVE-2014-2027
eGroupware before 1.8.006.20140217 allows remote attackers to conduct PHP object injection attacks, delete arbitrary files, and possibly execute arbitrary code via the (1) addr_fields or (2) trans parameter to addressbook/csv_import.php, (3) cal_fields or (4) trans parameter to calendar/csv_import.php, (5) info_fields or (6) trans parameter to csv_import.php in (a) projectmanager/ or (b) infolog/, or (7) processed parameter to preferences/inc/class.uiaclprefs.inc.php.
CVE-2014-2830
Stack-based buffer overflow in cifskey.c or cifscreds.c in cifs-utils before 6.4, as used in pam_cifscreds, allows remote attackers to have unspecified impact via unknown vectors.