Monthly Archives: April 2015

Fedora

Fedora 20 Security Update: prosody-0.9.8-1.fc20

Resolved Bugs
985563 – Logging, conf.d and log rotation
1085693 – prosody: resource consumption denial of service when using XMPP application-layer compression [fedora-all]
1091499 – Please use luajit instead of lua in F20+ (prosody requires lua 5.1; lua 5.2 is packaged)
1152126 – prosody-0.9.8 is available<br
Prosody 0.9.8
=============
A summary of changes in this release:
High
—-
* Ensure only valid UTF-8 is passed to libidn. It was found (CVE-2015-2059) that libidn can read beyond the boundaries of the provided buffer when an input string contains invalid UTF-8 sequences.
Systems where Prosody is compiled to use libICU are not affected by this issue.
Medium
——
* DNS: Fix traceback caused when DNS server IP is unroutable (issue 473)
* HTTP client: More robust handling of chunked encoding across packet boundaries
* Stanza router: Fix handling of ‘error’ ‘s with multiple children
Minor
—–
* c2s: Fix error reply when clients try to bind multiple resources on the same stream (issue 484)
* s2s: Ensure to/from attributes are always present on stream headers, even if empty (issue 468)
* Build scripts: Add –libdir option to ./configure to simplify building on some platforms
* Fix traceback in datamanager when used outside of Prosody (e.g. in some migration tools)
* mod_admin_telnet: Fix potential traceback in server:memory() command (issue 471)
* HTTP server: Improved debug logging
Prosody 0.9.7
=============
A summary of changes in this release:
* util.stanza: Don’t XML-escape whitespace
* prosodyctl: Fix traceback in ‘about’ command with LuaRocks 2.2.0
Prosody 0.9.6
=============
Note: This release disables SSLv3 by default, which has been shown to be insecure when used by clients. Clients that only support SSLv3 will no longer be able to connect. There are not many of these nowadays, but they exist.
A summary of changes in this release:
* certmanager, net.http: Disable SSLv3 by default
* net.http.parser: Support status code 101 and allow handling of the received data by plugins
* util.filters: Ignore filters being added twice (fixes issues on removal, i.e. when some plugins are reloaded/unloaded)
* mod_s2s: Close offending s2s streams missing an ‘id’ attribute with a stream error instead of throwing an unhandled error
* Networking API: Add ‘ondetach’ callback for listener objects, to prevent leaks when connections have their listener changed
* core.stanza_router: Stricter validation of stanzas
* mod_admin_adhoc: Mark ‘accountjids’ field as required in ‘end user sessions’ command (thanks Lloyd)
* mod_admin_adhoc: Add required to field in user deletion form too
* net.dns: Avoid duplicate cache entries
* util.stanza: Escape newlines and tabs (
) when serializing stanzas.
* util/dataforms: Make sure we iterate over field tags only
* mod_s2s: Capitalize log message
* mod_pubsub: Fix error type of ‘forbidden’ (change from ‘cancel’ to ‘auth’)
Prosody 0.9.5
=============
A summary of changes in this release:
* C2S: Fix traceback if a client opens a stream to component, which could cause a crash in combination with some versions of LuaEvent
* C2S, S2S: Log received invalid stream headers
* S2S: Fix case where stream headers were sometimes sent twice
* DNS: Ensure all pending requests get notified of a timeout when looking up a record
* DNS: Fix duplicated cache insertions by limiting outstanding queries per name to one
* xmppstream: Disable LuaExpat’s buffering
* xmppstream: Disable CharacterData merging after stream restarts
* xmppstream: Pass invalid stream headers to error handling
* Privacy lists: Correctly sort privacy list rules by order
* prosody: Check dependencies later in the startup sequence
* Config: Delay importing LuaFileSystem until needed by an Include line
* Config: Normalize VirtualHost and Component names
* prosodyctl: Normalize JIDs for adduser/passwd/deluser
* POSIX: Fix error reporting from disk space allocation
* POSIX: Verify that ‘pidfile’ is a string, show friendly error otherwise
* Dependency checking: Check that prosody is running under Lua 5.1. We don’t currently support any other versions. (LuaJIT identifies as 5.1)
* Compliance: Reset stream ID when resetting stream
* Compression: Log compression setup errors
* Console: Fix commands for adding and replacing name servers
* Console MUC commands: Fix error when a non-existent host is entered
* Filters: Prevent filters from being added twice
* Network: Transfer all available data between linked sockets
* dataforms: Add support for XEP-0221: Data Forms Media Element
Prosody 0.9.4
=============
A summary of changes in this release:
* Compression: Disallow compression on unauthenticated streams
* Core: Limit default read size and maximum stanza size
* Core: Enable SASL EXTERNAL by default for component s2s
* S2S: Warn if `s2s_secure_auth` and `s2s_require_encryption` have been set in conflicting ways
* S2S: Warn if no local network addresses were found, preventing successful s2s
* MUC: Fix traceback when a non-occupant tried to change an occupant’s role
* MUC: API: Fire an event when temporary rooms are destroyed after the last person leaves
* Telnet: Fixed traceback when listing users
* Telnet: Apply normalization to JIDs in user management commands
* HTTP: Fix directory detection in file server on Windows
* Plugins: Fix paths on Windows
* MOTD: Don’t strip blank lines from the message provided in the config
* prosodyctl: Better error reporting when generating certificates
* Makefile: Improve FreeBSD compatibility
* Multiple fixes to our migration tools, and support for importing MUCs from ejabberd
Prosody 0.9.3
=============
A summary of changes in this release:
* A config file passed as command line argument is no longer forgotten when config is reloaded
* MUC: Allow admins to always bypass restrict_room_creation
* Strip trailing ‘.’ when normalizing hostnames
* HTTP: Prevent silent connection failures
* Components: Alow easier overriding of component authentication by plugins
* Components: Enable TCP keepalives
* Migrator: Better error reporting and improved robustness
* S2S: Include IP in log messages, if hostname is unavailable
* TLS: Log error when initialization fails
Prosody 0.9.2
=============
Note: If you are upgrading from 0.8.x or earlier, please read the 0.9.0 upgrade notes at http://prosody.im/doc/release/0.9.0!
A summary of changes in this release:
* Debian/Ubuntu packages fixed to always generate per-system certs
* TLS: Improved cipher string, and use Prosody’s preferred ciphers instead of the client’s
* MUC: Fix for Spark clients not displaying room lists
For more details behind the security improvements, see the release announcement at http://blog.prosody.im/prosody-0-9-2-released/.

Panda Security

What is Sextortion, and how can it affect your business?

sextortion

Sexting can affect your company. Although it seems like there is little relevance between two people sharing intimate pictures and the workplace, in fact it can trigger a real business crisis.

Everything due to the so-called sextortion. Someone with whom we have shared intimate pictures blackmails you to obtain more pictures, money, sex or even, confidential information. All in exchange for not making the pictures public and ruining the victim’s reputation.

There are many ways sextortion can affect a company. The personal impact on the worker who is being blackmailed can impact on the company’s brand, but not only that, the extortionist can ask the victim for confidential information on the company he works for in exchange for not publishing the images, so the company may also be at risk.

Sextortion in four stages

As the expert in online reputation, Selva Orejon explains, Sextortion comes in four stages in which anyone can fall into the blackmailer’s trap, so stay vigilant.

  1. The cybercriminal looks for his target, analyzing who will be able to cope financially with the extortion or, just looking for the right profile. According to Orejón, they target people with low self-esteem that search the internet looking for a relationship and have a false sense of security and intimacy.
  2. The cybercriminal adjust himself to what his victim wants. Orejón says that the blackmailer’s main objective is becoming the perfect chameleon and ending up being the kind of person that their target is interested in.
  3. The blackmailer gains his victim trust to such extent that the victim sends him intimate pictures or videos with sexual content.
  4. Finally the cybercriminal carries out the extortion, asking the victim to give him something in return if he doesn’t want the pictures to go public. Something that obviously will ruin the victim’s reputation at home or at work.

Where does Sextortion happen?

You can fall victim of sextortion in any social network or chat. However, there are some networks were victims are more accessible and others in which the threat to the business world is more real.

Cybercriminals find sites like Badoo and other online dating platforms their perfect fishing ground. After all, these users are looking for someone to start a relationship with, so they are more open to make contact with strangers.

LinkedIn is where a case of sextortion can ruin our professional reputation. In order to get a quicker reaction from their victims, cybercriminals change from personal to professional blackmail. The criminal chooses his victim form the professional social network and then threatens to expose him to his contacts if he doesn’t give him what he wants.

Any kind of sextortion can jeopardize a company’s image, since the security and reputation of one of its employees is on the line. And, if the cybercriminal asks for business information as ransom, the company can face serious problems.

That’s way it’s important to advise your employees of the risks associated with sexting and the importance of taking all the necessary precautions when sharing pictures, especially if they are delicate.

The post What is Sextortion, and how can it affect your business? appeared first on MediaCenter Panda Security.

CentOS

CESA-2015:0863 Moderate CentOS 6 glibc SecurityUpdate

CentOS Errata and Security Advisory 2015:0863 Moderate

Upstream details at : https://rhn.redhat.com/errata/RHSA-2015-0863.html

The following updated files have been uploaded and are currently 
syncing to the mirrors: ( sha256sum Filename ) 

i386:
88b30b9049a6e88898b2e3f43927137c710ecbd50c41f2bdbb41315219a3ff54  glibc-2.12-1.149.el6_6.7.i686.rpm
892286a3246e0902d3ec52e456d546fc7b52b69b1287280fbf814e76da61c24e  glibc-common-2.12-1.149.el6_6.7.i686.rpm
9e0f2408fdc81b300fb1b3024134091c207e4549ff30df20589d27b53d48ed9b  glibc-devel-2.12-1.149.el6_6.7.i686.rpm
728c91fc9775209d89b50ab0cbc54aebc3782c70ebf5a8f8aba472d31b3aa098  glibc-headers-2.12-1.149.el6_6.7.i686.rpm
e3175defb27fdfed0f1d069b557eb4bc397fde08819e6fbc91def82f363ede64  glibc-static-2.12-1.149.el6_6.7.i686.rpm
f1abc2be2e57a7c83fd44b89baf9e8b2c2c5e742e736baae3731fc8a817ef58c  glibc-utils-2.12-1.149.el6_6.7.i686.rpm
19c66618274bb5b9b492fec2386e4be04677a1692ddc6de9fe7e231bb7b00ffd  nscd-2.12-1.149.el6_6.7.i686.rpm

x86_64:
88b30b9049a6e88898b2e3f43927137c710ecbd50c41f2bdbb41315219a3ff54  glibc-2.12-1.149.el6_6.7.i686.rpm
93e1b271cefb124042e6e268f8c1fa659827cb22afa8f5fa13b87ebbf378a603  glibc-2.12-1.149.el6_6.7.x86_64.rpm
d87d7e50b86050a97d4edc6047784ac979c102ab6c65027f740b04ed7216b4ea  glibc-common-2.12-1.149.el6_6.7.x86_64.rpm
9e0f2408fdc81b300fb1b3024134091c207e4549ff30df20589d27b53d48ed9b  glibc-devel-2.12-1.149.el6_6.7.i686.rpm
a1807441d3603faa89fa1250cbd161fb402419c0344c30f6de7818423d8e483a  glibc-devel-2.12-1.149.el6_6.7.x86_64.rpm
bf01eeb6d972b32e0a028077d548f6b9f5113397977ca38185b64aa8a44ed972  glibc-headers-2.12-1.149.el6_6.7.x86_64.rpm
e3175defb27fdfed0f1d069b557eb4bc397fde08819e6fbc91def82f363ede64  glibc-static-2.12-1.149.el6_6.7.i686.rpm
b4dba15e4838741f77dcb6b771e3eee19c46a6588f1e36450df5fde0e162a9d6  glibc-static-2.12-1.149.el6_6.7.x86_64.rpm
00edf45c654d9297a3ee2c982dfbcc81a1d96ec83c01c8fae6e872346724c439  glibc-utils-2.12-1.149.el6_6.7.x86_64.rpm
20211d194910ffc33a88d4f2d0d2e4076d702c63108bf180e88615e5f5b0b19c  nscd-2.12-1.149.el6_6.7.x86_64.rpm

Source:
e2f2b6a6fb6cd948561a3b434835bede80a9cfc997f6974e2509355c5ebf4f4e  glibc-2.12-1.149.el6_6.7.src.rpm
CentOS

CEEA-2015:0861 CentOS 6 crash Enhancement Update

CentOS Errata and Enhancement Advisory 2015:0861 

Upstream details at : https://rhn.redhat.com/errata/RHEA-2015-0861.html

The following updated files have been uploaded and are currently 
syncing to the mirrors: ( sha256sum Filename ) 

i386:
ae89791d574db4089e8c1039db89b9e2b5e29db15572b0645ffd8a62cae98fb7  crash-6.1.0-6.el6_6.i686.rpm
78992043643824307b96c8a2bcb295df654021bc5b8b61d3fd4787eb7f44a500  crash-devel-6.1.0-6.el6_6.i686.rpm

x86_64:
361ffa189ab96f88aa4cad846fd43d3cf47c12bd34e48c4574de7335c84f5272  crash-6.1.0-6.el6_6.x86_64.rpm
78992043643824307b96c8a2bcb295df654021bc5b8b61d3fd4787eb7f44a500  crash-devel-6.1.0-6.el6_6.i686.rpm
956bef581cf42896917d34642ee52b88414ae9bd3036d6d3dfb13cabb3e983be  crash-devel-6.1.0-6.el6_6.x86_64.rpm

Source:
ff598be0b6c6ccc5321d76cf28040cdb23d3f862cd0a3085fb8bd39df455b76f  crash-6.1.0-6.el6_6.src.rpm
AVG

How to tell if an app has in-app purchases

News emerged recently of a California woman suing Google for the return of thousands of dollars taken without her knowledge via in-app microtransactions.

After upgrading a free app via the Google Play store, hackers got hold of Susan Harvey’s details and between March 2013 and August 2014 ran up thousands of dollars across 650 in-app purchases without any alerts and notifications being sent to the victim.

 

Checking for in-app purchases

It’s easy to see if an app allows in-app purchases, just visit the Apple App Store or the Google Play Store.

Google Play Store

Android

 

Apple App Store

iOS

 

While it is not yet determined who is to blame for this attack, one thing we can all do to help keep ourselves safe from fraud or mobile attacks is to carefully check the permissions of any apps we install on our devices.

Check out this video for tips on which permissions to look out for when installing a new app.

Video

Make Sure You Check These Permissions

 

In the video, Michael highlights these top permissions to check when installing an app:

  • Check the app store that the app contains in app purchases
  • Access to the internet
  • Access to phone and call information
  • GPS and precise location
  • Access to photos/media/files
  • Camera and microphone access