Heap-based buffer overflow in the ALGnew function in block_templace.c in Python Cryptography Toolkit (aka pycrypto) allows remote attackers to execute arbitrary code as demonstrated by a crafted iv parameter to cryptmsg.py.
Monthly Archives: February 2017
CVE-2016-1888
The telnetd service in FreeBSD 9.3, 10.1, 10.2, 10.3, and 11.0 allows remote attackers to inject arguments to login and bypass authentication via vectors involving a “sequence of memory allocation failures.”
Online gaming safety tips
Mobile gaming is changing the shape of online gaming but how safe is it?
Mobile gaming is huge! According to a report recently released by market research firm SuperData, the global mobile gaming sales revenue in 2016 was over $40 billion. The mobile gaming market is now bigger than the global tea market and the global naval market. According to SuperData, the trend will only increase as mobile gaming is getting the support of the emerging multi-billion VR industry.
In 2016 more than 97% of VR headsets sold were for mobile devices. Having in mind the price Oculus, Sony and HTC are offering for their flag products; it is not a surprise that budget solutions such as Google cardboard and Samsung Gear VR ended up accounting for almost all VR headsets sold last year.
While maritime safety and tea are losing the battle against Candy Crush Saga and Pokemon GO, the security of the people enjoying the perks of their ultra-powerful mobile handsets might be compromised.
Here’s a top 5 list for mobile gaming dangers
Virtual and Augmented Reality
It may sound tempting to be able to teleport yourself onto a roller coaster while sitting on the couch at home, but games which break the perception of the presence could be dangerous. Similar to motion sickness, some VR players tend to experience virtual reality sickness. Stop gaming immediately should you start feeling disoriented or you have symptoms such as a headache or nausea. There are reported cases of people who lost their lives while hunting Pokémons so augmented reality could be dangerous too. Keep your eyes open for the surrounding area!
Hidden Fees
You’ve finally found the most amazing mobile game in the world – it has amazing graphics, it is real time, and the game is endorsed by your favourite celebrity! What could go wrong? A lot of things, such as the status of your bank account. Mobile games sometimes have in-app purchases, make sure you check before getting an additional weapon or skipping an advert that is currently playing it may end up costing you real money. Unfortunately, they do not accept doubloons in the real world, so the more prepared you are, the better.
It is a well-known fact that 90% of the children, aged 12 years or less, are mobile gamers (using their cell phone or a borrow from a family member) and these phones need to be protected to avoid the potentials risks of uncontrolled purchases.
Approved Apps
Make sure to always download applications from the Play Store or the App Store. Sometimes apps connect to your social media profiles, and they can see personal information such as your full name, date of birth, location and even your home address.
If the app you have on your phone is not approved, you may end up not only sharing all this valuable information with the wrong people, but you may install a virus on your phone that can lurk around your mobile handset and steal your passwords. Stay alerted and stick to the approved apps on the Play Store and the App Store, and even then, use services that allow you to scan the applications that you are installing on your phone.
To use this feature, you must set an unlock PIN and select the apps you want to lock. Should you forget your PIN, you’ll be able to reset it through your Panda Security account.
Maturity filters
Children already spend more time on the Internet than watching TV. Their favourite content is on emerging video platforms such as YouTube. A huge percentage of children nowadays have smartphones, and even though regulations tend to be strict, you don’t want your kid to be able to access chat rooms and content that is not monitored by you. Predators thrive on new ways of getting in touch with vulnerable people, and mobile gaming is one of those places.
Some games have chat rooms where people can socialize. Relying on admins may not be a full solution so make sure you know where you and your kids go while taking a breath before launching the next game on your cell phone. Always check out the PEGI ratings of an app before you let your child access it unless you want your 13-year-old son to get better than you on Texas hold ’em poker. Kids need restriction so don’t forget to use a PIN-protect access to the apps you want to control.
Panda’s Mobile Security for Android has a feature that allows you to PIN-protect access to your apps. The feature comes with privacy protection that prevents from unauthorized access to messaging apps and social media sites. The feature also comes with parental control functions that help you restrict the little ones from accessing certain apps, games, etc.
Expect the unexpected
Hackers are cruel and unfortunately technology savvy. They are always finding new ways of approaching you and your loved ones. Innovation is what they do best, and even though antivirus companies tend to be a step ahead of them, not everyone has protection. As mobile phones and mobile gaming are taking an increasingly bigger part of our lives, we firmly advise you to keep your eyes open and always bear in mind that sometimes even the App Store and the Play Store might miss something and let you install an infected app.
Good news is Panda allows you to scan applications before installing or updating an app.
While hackers keep finding new ways to get your money, we are solely focused on preventing them from being successful by constantly adapting to their new habits.
Luckily, Panda Security offers the best mobile security protection for all your devices including cell phones and tablets. Check out our security service solution here and be protected while gaming on your mobile device.
The post Online gaming safety tips appeared first on Panda Security Mediacenter.
Coppermine Gallery 1.5.44 Directory Traversal
Coppermine Gallery versions 1.5.44 and below suffer from a directory traversal vulnerability.
OpenText Documentum D2 4.x Remote Code Execution
OpenText Documentum D2 version 4.x contains vulnerable BeanShell (bsh) and Apache Commons libraries and accepts serialized data from untrusted sources, which leads to remote code execution.
Cisco Security Response 20170214-smi
Cisco Security Response – Several researchers have reported on the use of Smart Install (SMI) protocol messages toward Smart Install clients, also known as integrated branch clients (IBC), allowing an unauthenticated, remote attacker to change the startup-config file and force a reload of the device, upgrade the IOS image on the device, and execute high-privilege CLI commands on switches running Cisco IOS and IOS XE Software. Cisco does not consider this a vulnerability in Cisco IOS, IOS XE, or the Smart Install feature itself but a misuse of the Smart Install protocol that by design does not require authentication.
Red Hat Security Advisory 2017-0270-01
Red Hat Security Advisory 2017-0270-01 – The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix: A use-after-free vulnerability was found in the kernel’s socket recvmmsg subsystem. This may allow remote attackers to corrupt memory and may allow execution of arbitrary code. This corruption takes place during the error handling routines within __sys_recvmmsg() function.
Red Hat Security Advisory 2017-0275-01
Red Hat Security Advisory 2017-0275-01 – The flash-plugin package contains a Mozilla Firefox compatible Adobe Flash Player web browser plug-in. This update upgrades Flash Player to version 24.0.0.221. Security Fix: This update fixes multiple vulnerabilities in Adobe Flash Player. These vulnerabilities, detailed in the Adobe Security Bulletin listed in the References section, could allow an attacker to create a specially crafted SWF file that would cause flash-plugin to crash, execute arbitrary code, or disclose sensitive information when the victim loaded a page containing the malicious SWF content.
HP Security Bulletin HPESBGN03697 1
HP Security Bulletin HPESBGN03697 1 – A security vulnerability in DES/3DES block ciphers used in the TLS protocol could potentially impact HPE Business Service Management 9.2x and Application Performance Management (APM) 9.30 resulting in remote disclosure of information, also known as the SWEET32 attack. Revision 1 of this advisory.
HP Security Bulletin HPESBHF03703 1
HP Security Bulletin HPESBHF03703 1 – Potential security vulnerabilities with OpenSSL have been addressed in HPE Network Products including Comware v7 and VCX. The vulnerabilities could be remotely exploited resulting in disclosure of information. Revision 1 of this advisory.