SAP MII versions 12.2, 14.0, and 15.0 allow Base64 and DES as an encryption algorithm.
Monthly Archives: February 2016
RVAsec 5 Call For Papers
RVAsec is a Richmond, VA based security convention that brings top industry speakers to the mid-Atlantic region. In its fourth year, RVAsec 2015 attracted nearly 400 security professionals from across the country. For 2016, the conference is a two day and dual-track format, with a mixed focus on technical and management/business presentations. It will be held June 2nd through the 3rd, 2016, in Richmond, VA, USA.
Xymon 4.3.x Buffer Overflow / Code Execution / Information Disclosure
Xymon 4.3.x versions suffers from buffer overflow, information disclosure, code execution, cross site scripting, and various other vulnerabilities.
Ubuntu Security Notice USN-2898-2
Ubuntu Security Notice 2898-2 – It was discovered that Eye of GNOME incorrectly handled certain large images. If a user were tricked into opening a specially-crafted image, a remote attacker could use this issue to cause Eye of GNOME to crash, resulting in a denial of service, or possibly execute arbitrary code.
Ubuntu Security Notice USN-2896-1
Ubuntu Security Notice 2896-1 – Daniel Genkin, Lev Pachmanov, Itamar Pipman and Eran Tromer discovered that Libgcrypt was susceptible to an attack via physical side channels. A local attacker could use this attack to possibly recover private keys.
Ubuntu Security Notice USN-2898-1
Ubuntu Security Notice 2898-1 – It was discovered that GTK+ incorrectly handled certain large images. A remote attacker could use this issue to cause GTK+ applications to crash, resulting in a denial of service, or possibly execute arbitrary code.
Ubuntu Security Notice USN-2897-1
Ubuntu Security Notice 2897-1 – Hanno Boeck discovered that Nettle incorrectly handled carry propagation in the NIST P-256 elliptic curve. Hanno Boeck discovered that Nettle incorrectly handled carry propagation in the NIST P-384 elliptic curve. Niels Moeller discovered that Nettle incorrectly handled carry propagation in the NIST P-256 elliptic curve. Various other issues were also addressed.
Red Hat Security Advisory 2016-0174-01
Red Hat Security Advisory 2016-0174-01 – Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. A stored cross-site scripting flaw was found in the smart class parameters/variables field. By sending a specially crafted request to Satellite, a remote, authenticated attacker could embed HTML content into the stored data, allowing them to inject malicious content into the web page that is used to view that data.
25 Day Offline Holiday: Can a techie do it?
To get away from it all, I decided to take an unplugged vacation. But can I survive it?
Chile’s Atacama Desert is the perfect destination for an “Unplugged” holiday
The day before I left Brazil for my vacation, a young lady who works with me said, “My vacation concept is different than yours.” She said that her vacation is time to take a break, to disconnect. So she unplugs all her devices and goes offline.
I’ve thought I could do the same while traveling to Chile. I won’t write about the trip itself, but about my Offline Holiday. For sure there are a lot of free Wi-Fi hotspots, and I have Avast SecureLine and Avast Wi-Fi Finder, so I could be secure the entire time. But, that’s not the point.
I just want to see what will happen in my life, and in my body and mind, being 25 days offline.
Day 1. I’m using Windows Preview Pro 11102, my machine is fully updated and Avast Software Updater shows that all the software on my computer is OK. I can’t believe that I will disable Avast!
Yes, as a rule you should keep your protection fully updated and on. But, I ran a full scan before beginning this offline journey and with no connection to the internet, I am not afraid. I am traveling for the first time in this new country, but my favorite apps do not work and I have no internet. Thankfully, I’ve installed an off-line map and GPS app. This option is showing me the way.
Day 2. I thought it would be easy, like when I stopped smoking 15 years ago. “I can manage it,” I told myself.
I’ve disabled some of my startup items. Why should I start a browser, an online backup, and an email client if I’m offline? I’ve put my smartphone in airplane mode and the battery stays charged all day. Isn’t it good?
My fitness app did work. GPS is there, but without internet it’s not loading. So I’ve moved to my backup fitness app that I tested offline before. Worked. Good. I don’t need anything more.
Day 3. Everything is quiet… So quiet… No smartphone notifications… Not a single message and email, nor my RSS showing any news… Will I make it? “25 days is too much,” I thought. “No, I’ll stay determined!”
I bought a newspaper! Paper! International news shows my country hasn’t changed a lot in a few days. Why worry with getting news all the time? I’m on holiday.
Day 4. I hate to have Windows saying my protection is off, so I disabled the notifications. No problem. Everything is still working. No email. No messages.
I’ve started to enjoy the simple things more. Chile is a fantastic country. I appreciate the food and the fruits (not that I could read about them first on the net) and a lot of fantastic wines.
Day 5. I’m traveling in a very dry part of the country. Who needs an app that notifies you when you need to drink water, I think to myself? I’m drinking a lot of water anyway. The Atacama Desert seems like Mars. Recently I watched a DVD movie called Mars with Matt Damon. In the movie the stranded astronaut has communication with Earth but I’m alone here.
Well, not exactly, I’m surrounded by people and technology, just crazy enough to be doing this social experiment of being offline.
Day 6. I’ve committed a sin today. I had to send some blog articles to Deborah. I promise that I borrowed a phone from a friend of mine, prepared the email, logged into my Gmail account with two-authentication factor – how exciting is to be secure! – and sent them to her. Generally, she thanks me about my hard work. She will do the same now. Nobody will be listening. I am tempted to go further and read tons of emails that have accumulated in my inbox, but I don’t give in. No, I logged out.
Day 7. If you’re reading this post, that means Deborah received my email. I was at a museum and with public Wi-Fi, I just sent this to her. I promise, no other communication. Avast SecureLine gave me protection over this public Wi-Fi, so I logged into my Gmail account and sent her the text using my phone.
I suppose I’ll continue next week. Or maybe I’ll quit. This is harder than I thought…
Wish me luck and keep yourself connected to our blog with Avast fully updated. Remember: I’m offline, not you. Will I survive?
JMX2 Email Tester Remote Shell Upload
JMX2 Email Tester suffers from a remote shell upload vulnerability.