Ubuntu Security Notice 2901-1 – It was discovered that xdelta3 incorrectly handled certain files. If a user or automated system were tricked into processing a specially-crafted file, a remote attacker could use this issue to cause xdelta3 to crash, resulting in a denial of service, or possibly execute arbitrary code.
Monthly Archives: February 2016
pyClamd 0.3.17
pyClamd is a python interface to Clamd (Clamav daemon). By using pyClamd, you can add virus detection capabilities to your python software in an efficient and easy way. Instead of pyClamav which uses libclamav, pyClamd may be used by a closed source product.
GNU glibc Vulnerability
Original release date: February 17, 2016
GNU glibc contains a buffer overflow vulnerability in the DNS resolver. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system.
Users and administrators are encouraged to review Vulnerability Note VU#457759 and the glibc Project Notification for additional details and to refer to their respective Linux or Unix-based OS vendor for an appropriate patch.
This product is provided subject to this Notification and this Privacy & Use policy.
Xen Project Explains Patch Snafu
Xen has acknowledged an oversight where it failed to provide a pair of crucial security patches in its most recent update.
Surviving my 25 day Offline Holiday
If you’re reading this, you probably read Part I of my social experiment, 25 Day Offline Holiday: Can a techie do it? I’m trying to live without the Internet for 25 days while I’m on vacation in Chile. Well, not absolutely without. It’s available, but I’ve banned myself from receiving or answering emails or messages, playing with the apps on my phone… that sort of thing.
I am on an Offline Holiday. Can I survive it?
I discovered that I can run without a fitness app tracking my progress
Day 8. Today, while running under the sun and watching the fields, I wondered what Bob would think about my 25-day experiment? Bob is my fellow Avast evangelist and like me, he’s extremely active on the Avast Forum. He makes presentations all over the United States about security, anti-malware, and how to be safe while connected. I guess he’s never recommended Avast to anyone offline. All he must be doing, while I’m on my offline vacation, is teaching people to be protected, have their antivirus fully updated, and so forth.
And what about David, another Avast evangelist? I wonder if he is solving all the issues on the Avast Forum? Would he survive in England without being connected? What about Asyn? Has he recommended that you read any Avast Blog articles yet? And Polonus? Is he fighting off online malware?
I’m not sure what my friends are doing, as I’ve been offline for over a week now.
Look for yourself: Join the Avast Community Forum and meet real people that can guide you through online security. Tell them I said hello.
Day 9. Nothing new. I’m bored because I can only read the local newspaper. I have a lot of time to watch movies. My health is very good: I lost some weight. But I don’t know for sure. Maybe it’s wishful thinking since I’m not following my app.
Day 10. I love ice cream and today I have one. Isn’t life beautiful?
As I write this, my thoughts drift back to what I enjoy doing the most when I’ve got an Internet connection – helping people stay secure when they’re online. If you’re connected, you need to be safe.
I can’t imagine connecting to the internet without the protection of Avast SecureLine in all these cafes offering public Wi-Fi. As I sit here eating my ice cream, and not looking down at my phone, I watch the people. It’s a pity that I can’t teach all of the guys here that their internet traffic could be eavesdropped on without a proper VPN. Well, Avast Mobile Security team, at least I’m safe since I’m offline. Plenty of work for you…
Here, the sun is in the sky, and I have all day to enjoy myself. OK, now what…?
Day 11-13. Nothing new during these past few days, I mean, nothing interesting enough to be written about here in the Avast blog. As I don’t know if Deborah published Part I, maybe these musings are useless?
I may be offline, but my thoughts are connected to my work with Avast. I miss everyone and hope the Avast team is working hard to protect more than 230 million people round the world. They have one less to protect for another week and a half.
Did you see the picture of the Avast Virus Lab some days ago? Wow, all that malware coming to your devices. But I’m sure if you’re reading this, you are smart enough to protect both your notebook and your mobile devices.
Day 14. Hmmm… I wonder if this blog is useful to anyone? Did anyone comment on part one? Did our social media team receive any comments about my experience on Facebook or Twitter?
The worst part about being offline for the past 14 days, is that I don’t really know what is happening. No feedback. No likes, plus 1s, or retweets. No news is good news, I suppose.
Follow Avast on Facebook, Twitter, YouTube, and Google+ where we keep you updated on cybersecurity news every day.
Magnitude of glibc Vulnerability Coming to Light
Researchers are pondering the magnitude of the glibc vulnerability and its exploitability via DNS.
Nodejs – Access bypass – Moderately Critical — DRUPAL-SA-CONTRIB-2016-007
- Advisory ID: DRUPAL-SA-CONTRIB-2016-007
- Project: Node.js integration (third-party module)
- Version: 7.x, 8.x
- Date: 2016-February-17
- Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All
- Vulnerability: Information Disclosure
Description
This module provides an API that other modules can use to add realtime capabilities to Drupal, specifically enabling pushing updates to open connected clients.
The module doesn’t disconnect unauthenticated sockets, allowing those sockets to receive broadcast messages. For sites that only serve authenticated pages, or only allows Node.js connections from authenticated users, the expectation is that only authenticated Drupal users will see broadcast messages.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
- Node.js 7.x-1.x versions prior to 7.x-1.11.
- Node.js 8.x-1.x beta versions prior to 8.x-1.0.
Drupal core is not affected. If you do not use the contributed Node.js integration module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Node.js module for Drupal 7.x, upgrade to Node.js 7.x-1.11.
- If you use the beta Node.js module for Drupal 8.x, upgrade to Node.js 8.x-1.0.
Also see the Node.js integration project page.
Reported by
Fixed by
Coordinated by
- Michael Hess of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Drupal version:
Commerce Authorize.Net SIM/DPM Payment Methods – Access Bypass – DRUPAL-SA-CONTRIB-2016-006
- Advisory ID: DRUPAL-SA-CONTRIB-2016-006
- Project: Commerce Authorize.Net SIM/DPM Payment Methods (third-party module)
- Version: 7.x
- Date: 2016-February-17
- Security risk: 15/25 ( Critical) AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All
- Vulnerability: Access bypass
Description
This module enables you to make credit card payments for Drupal Commerce orders via the Authorize.Net payment gateway using either their SIM (hosted payment page) or DPM (direct post method) mechanisms.
The module doesn’t sufficiently protect against the premature triggering of order completion without successful payment by the manual entry of a specially-constructed URL which contains the correct payment redirect key.
This vulnerability is mitigated by the fact that an attacker must know the format of the redirect URL and the current payment redirect key. It’s also worth noting that orders prematurely completed in this fashion will NOT record a successful payment and thus show an unpaid balance.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
- Commerce Authorize.Net SIM/DPM Payment Methods versions prior to 7.x-1.4.
Drupal core is not affected. If you do not use the contributed Commerce Authorize.Net SIM/DPM Payment Methods module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Commerce Authorize.Net SIM/DPM Payment Methods module for Drupal 7.x, upgrade to Commerce Authorize.Net SIM/DPM Payment Methods 7.x-1.4
Also see the Commerce Authorize.Net SIM/DPM Payment Methods project page.
Reported by
Fixed by
- Matt White
- Jerry Hudgins the module maintainer
Coordinated by
- Rick Manelius of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
Drupal version:
Avira wins two AV Test awards for its quiet approach to usability and repair
Avira Antivirus Pro won its first ever double header from AV Tests, taking home the awards for “Usability” and “Repair for Security Suite”, following its top performance during the independent testing agency’s product analysis.
The post Avira wins two AV Test awards for its quiet approach to usability and repair appeared first on Avira Blog.
Adobe Flash TextField Constructor Type Confusion
There is a type confusion vulnerability in the TextField constructor in AS3. When a TextField is constructed, a generic backing object is created and reused when subsequent TextField objects are created. However, if an object with the same ID has already been created in the SWF, it can be of the wrong type. The constructor contains a check for this situation, though, and throws an exception and sets a flag to shut down the player if this occurs. The backing object is then set to be of type TextField to avoid any modifications that have been made on it by the constructor from causing problems if it is used as an object of its original type elsewhere in the player. However, if the exception thrown by the constructor is caught, the exception handler can create another TextField object, and since the type of the generic backing object has been changed, an object of the wrong type is now backing the TextField, which makes it possible to set the pointers in the object to integer values selected by the attacker. The PoC swf for this issue needs to be created by hand.