HP Security Bulletin HPSBHF03310 1 – Potential security vulnerabilities have been identified with certain HP Thin Clients running Windows Embedded Standard 7 (WES7) and Windows Embedded Standard 2009 (WES09) and all versions of HP Easy Deploy. The vulnerabilities could be exploited remotely to allow elevation of privilege and execution of code. Note: HP Easy Deploy was bundled in versions of HP Easy Tools prior to version 3.0.1.1650. Revision 1 of this advisory.
Monthly Archives: April 2015
Red Hat Security Advisory 2015-0790-01
Red Hat Security Advisory 2015-0790-01 – OpenStack Compute launches and schedules large networks of virtual machines, creating a redundant and scalable cloud computing platform. Compute provides the software, control panels, and APIs required to orchestrate a cloud, including running virtual machine instances and controlling access through users and projects. It was discovered that the OpenStack Compute console websocket did not correctly verify the origin header. An attacker could use this flaw to conduct a cross-site websocket hijack attack. Note that only Compute setups with VNC or SPICE enabled were affected by this flaw.
Red Hat Security Advisory 2015-0789-01
Red Hat Security Advisory 2015-0789-01 – PackStack is a command-line utility for deploying OpenStack on existing servers over an SSH connection. Deployment options are provided either interactively, using the command line, or non-interactively by means of a text file containing a set of preconfigured values for OpenStack parameters. PackStack is suitable for proof-of-concept installations. PackStack is suitable for deploying proof-of-concept installations. It was discovered that the puppet manifests, as provided with the openstack-puppet-modules package, would configure the pcsd daemon with a known default password. If this password was not changed and an attacker was able to gain access to pcsd, they could potentially run shell commands as root.
Red Hat Security Advisory 2015-0788-01
Red Hat Security Advisory 2015-0788-01 – The novnc package provides a VNC client that uses HTML5 and includes encryption support. It was discovered that noVNC did not properly set the ‘secure’ flag when issuing cookies. An attacker could use this flaw to intercept cookies via a man-in-the-middle attack. All novnc users are advised to upgrade to this updated package, which corrects this issue.
Red Hat Security Advisory 2015-0791-01
Red Hat Security Advisory 2015-0791-01 – Red Hat Enterprise OpenStack Platform Installer is a deployment management tool. It provides a web user interface for managing the installation and configuration of remote systems. Deployment of changes is performed using Puppet. Additionally, Dynamic Host Configuration Protocol, Domain Name System, Preboot Execution Environment, and Trivial File Transfer Protocol services can be provided. Controlling these services also enables provisioning of physical systems that do not yet have an operating system installed. It was discovered that the puppet manifests, as provided with the openstack-puppet-modules package, would configure the pcsd daemon with a known default password. If this password was not changed and an attacker was able to gain access to pcsd, they could potentially run shell commands as root.
phpTrafficA 2.3 Cross Site Scripting
phpTrafficA versions up to 2.3 suffer from a persistent cross site scripting vulnerability.
bloofoxCMS 0.5.0 Cross Site Scripting
bloofoxCMS version 0.5.0 suffers from a cross site scripting vulnerability.
Security Notice For CA Spectrum
CA Technologies Support is alerting customers to multiple potential risks with CA Spectrum. Two vulnerabilities exist that can potentially allow a remote authenticated attacker to gain sensitive information or escalate privileges. The first issue is a stored cross-site scripting vulnerability which occurs due to insufficient validation of requests. An authenticated remote attacker can potentially execute script with increased privileges. The second issue occurs due to insufficient validation of data sent using serialized Java objects. A remote authenticated attacker can potentially gain administrative privileges on the host.
One hacker per month convicted under UK Computer Misuse Act
The Computer Misuse Act has resulted in an average of just one criminal conviction per month for the past 23 years, according to UK Home Office ministers.
The post One hacker per month convicted under UK Computer Misuse Act appeared first on We Live Security.
Is our data ready for the wearable health revolution?
This week MEF issued a report on the use of wearable devices in the health sector, both relating to personal consumption and also when recommended or used by health professionals.
According to the report, “the global health and fitness app market is currently worth $4 billion, and is predicted to be worth $26 billion by 2017”. This means that we’re going to hear a lot more about health wearables in the future.
The biggest selling point for wearables is their convenience. They can passively track our activity, pulse and other vital data points that allow us to make health and lifestyle decisions.
Imagine a future where a patient that needs frequent monitoring for diagnosis can go about their daily routine while a wearable tracks and transmits their data back to the doctor for analysis.
This remote diagnosis is potentially an incredibly simple way to provide doctors with the information they need without waiting time, travel time and consultation time.
There have been some very interesting developments in this area over the past year as well, with Google researching contact lenses that measure blood sugar to the use of wearable camera technology used in surgery so a remote surgeon can assist.
MEF’s report also showed that the adoption of wearable technology in health is lower in Western countries and some of the lowest is seen in Germany and France.
I believe that patients in these countries are more aware of data security and privacy risks having seen many data breach stories in the news over the last few years.
Trust and data security are fundamental to the success of mHealth. Wearables are blurring the lines between recreational and medical data.
By law, medical data needs to be encrypted and authenticated (HIPPA in the USA for example) but recreational data as captured by most wearable devices does not.
Moreover, manufacturers of wearable fitness trackers and other activity monitors are not operating in a regulated market and companies could be using this data in ways that we neither agree with nor understand (even though it may be in their policy documents).
If commercial companies are to hold data that we really only expect medical companies to hold then maybe the regulations should apply to them as well.
While it may be boring, I would recommend reading the privacy policy and terms of use of anything collecting what is very personal and sensitive data and making a choice on whether you want to share this data.
