Original release date: July 30, 2015
Cisco has released software updates to address a vulnerability in Cisco IOS XE Software for ASR 1000 Series Aggregation Services Routers. Exploitation of this vulnerability may allow a remote attacker to cause a denial-of-service condition.
US-CERT encourages users and administrators to review Cisco Security Advisory and apply the necessary updates.
This product is provided subject to this Notification and this Privacy & Use policy.
Resolved Bugs
817696 – CVE-2012-2150 xfsprogs: xfs_metadump information disclosure flaw<br
Gabriel Vlasiu reported that xfs_metadump, part of the xfsprogs suite of tools for the XFS filesystem, did not properly obfuscate data. xfs_metadump properly obfuscates active metadata, but the rest of the space within that fs block comes through in the clear. This could lead to exposure of stale disk data via the produced metadump image.
The expectation of xfs_metadump is to obfuscate all but the shortest names in the metadata, as noted in the manpage:
By default, xfs_metadump obfuscates most file (regular file, directory and symbolic link) names and extended attribute names to allow the dumps to be sent without revealing confidential information. Extended attribute values are zeroed and no data is copied. The only exceptions are file or attribute names that are 4 or less characters in length. Also file names that span extents (this can only occur with the mkfs.xfs(8) options where -n size > -b size) are not obfuscated. Names between 5 and 8 characters in length inclusively are partially obfuscated.
While the xfs_metadump tool can be run by unprivileged users, it requires appropriate permissions to access block devices (such as root) where the sensitive data might be dumped. An unprivileged user, without access to the block device, could not use this flaw to obtain sensitive data they would not otherwise have permission to access.
Being a finalist at Technovation 2015 means competing against over 400 apps from 64 different countries. The challenge? To build an app in just a few months that would help solve real-world problems such as sports concussions or childhood obesity.
I had the pleasure of leading the “Security By the Numbers” workshop at Technovation 2015 #wpitch2015. This workshop is designed to help the young finalists visualize themselves as entrepreneurs and transition their prototypes into market-ready apps.
So what defines a market-ready app? Increasingly, the answer is security. From the continuous stream of high-profile data breaches to the rising prevalence of malicious apps on Android, the lack of app security has proven to be a gold mine for cybercrime. In fact, a recent study by IBM found that the cost of data breach could be as high as $300 per single lost record and $154 per record on average.
As with all good design, app security is not a simple afterthought. That’s because security to the app is like a shell to a turtle, it’s a skeletal structure that needs to be designed for.
This workshop used an AVG app with over a million users to illustrate three key principles of app security:
This was particularly beneficial for the students because it provided them a glimpse into the technical infrastructure and monitoring that can support a large scale mobile application.
My favorite feedback from the workshop was “Technovation was an enlightening experience and helped me see this as a career, this workshop helped me understand what it would take to take my ideas to market.”
It was an inspiration to be surrounded by so many bright, driven and accomplished young women. I’m excited to see a future with a more diverse and inclusive tech industry!
AVG Technologies @AVGFree is a gold sponsor of Technovation thanks to the efforts of Anar Simpson @AnarSimpson, Todd Simpson @ToddSimpson and Judith Bitterli @JudithBitterli.
Mariya Snow @mariyasnow is a Senior Engineer at AVG Technologies.
United Airlines customer flight records have been lost in a data breach it has been reported.
The post United Airlines customer flight records breached appeared first on We Live Security.
Last week we held the final roadshow on the Raise Your Game UK tour. Raise Your Game is an initiative aimed at helping Managed Service Providers to become more profitable.
The event was held at the Emirates Stadium, home to Arsenal Football Club and was a fitting venue to discuss taking MSP business practices to the next level.
There were experts from a hosting of leading companies including Epsom, CompTIA, Infrascale and Tigerpaw, each giving unique insight into what makes a profitable MSP.
The interactive sessions covered every aspect of operating an MSP from sales and marketing to security and strategic partnerships.
As headline sponsor, AVG was present to help guide the conversation and Francois Daumard, AVG’s VP of Global Channel Sales, spoke about the critical importance of forging partnerships in the MSP industry.
Afterwards, Sales Engineer Manager Matt Chinnery showed the MPS the new Managed Workplace platform that enables MSPs to easily onboard, easily gain access to key reports and effectively manage their clients to help maximize profits and improve security.
After the sessions concluded, the guests were treated to a stadium tour of the Emirates.
Visit the full gallery on Flickr
This is one of many roadshows that AVG Business are holding throughout the country, watch out for the next dates coming shortly or contact for more information.
Moonpig has warned customers that some of their email addresses, passwords, and account balances have been published after what it calls a “security issue”. The company, which sells custom greeting cards, said in a message to users that attackers were not able to get any credit card information, as Moonpig does not store that data. […]
The packet-reassembly implementation in Cisco IOS XE 3.13S and earlier allows remote attackers to cause a denial of service (CPU consumption or packet loss) via fragmented (1) IPv4 or (2) IPv6 packets that trigger ATTN-3-SYNC_TIMEOUT errors after reassembly failures, aka Bug ID CSCuo37957.
[security bulletin] HPSBGN03367 rev.1 – HP TransactionVision with RC4 Stream Cipher, Remote Disclosure of Information
Cross-Site Scripting (XSS) in qTranslate WordPress Plugin