BeyondTrust

Security in Context: The BeyondTrust Blog

Welcome to Security in Context

Bringing you news and commentary on solutions and strategies for protecting critical IT infrastructure in the context of your business.

Filter:

Posts Tagged ‘vulnerability’

ScanMetrics-screenshot

Adobe Flash Player and Air (APSB12-24) Critical Memory Vulnerabilities – November 2012

Posted November 9, 2012    Jerome Diggs

Nine new audits are being released in our Retina vulnerability scan engine to help customers identify a security vulnerability that can enable an attacker to gain control of a vulnerable system (CVE-2012-5274, CVE-2012-5275, CVE-2012-5276, CVE-2012-5277, CVE-2012-5278, CVE-2012-5279, CVE-2012-5280) These nine new audits have been released with Retina Network Community and the commercial version of Retina…

Tags:
, , , ,
img-mobile

Most Versions of Android have SMiShing Vulnerability

Posted November 5, 2012    Bobby DeSimone and Scott Ellis

Researchers at NC State University have discovered a vulnerability that allows a zero-permission App to fake SMS messages and thus lead to potential SMS Phishing (or SMiShing).   By creating fake SMS messages from legitimate looking sources, a mal-ware app could fool a user into clicking on a link to a rogue site with the intension of…

Tags:
, , , , , , , ,
img-01-resized-600.jpg

MS SQL Cross-Site Scripting (XSS) News – October 2012

Posted October 15, 2012    Jerome Diggs

Eight new audits are being released in our Retina vulnerability scan engine to help close a security vulnerability that can enable an attacker to gain control of a MS SQL Database Server running SQL Reporting Services via Cross-Site Scripting (CVE-2012-2552, MS12-070). These eight new audits have been released with Retina Network Community and the commercial…

Tags:
, , , , ,
img

Don’t say “Lockdown”!

Posted October 15, 2012    Peter McCalister

Here at BeyondTrust, we have been fortunate to be able to speak with thousands of security professionals in dozens of industries, and it is astonishing how differently organizations assess risk and approach computer security. Some organizations are very strict about security and are able to completely lock down desktops. Others are significantly more lax about…

Tags:
, ,
weakcertificates-retina

Retina Helps Identify Weak Certificates

Posted September 25, 2012    Jerome Diggs

Microsoft has released a Security Advisory for the upcoming patch to increase minimum bit levels of certificates to 1024 bit security advisory 2661254.  The expected release date for this patch is Oct 9th at which time the update will be available through Windows Update. This change to the minimum bits level of certificates will change…

Tags:
, , , , ,
IE-0day

Mmm, Smells Like 0day

Posted September 17, 2012    BeyondTrust Research Team

Just when you thought we were out of the woods, Internet Explorer 0day shows up, in the wild. Here’s what you need to know about the vulnerability: Internet Explorer 6, 7, 8, and 9 are vulnerable (UPDATE: Out-of-band patch available now!) Use-after-free when the CMshtmlEd object is deleted and then the same area in memory…

Tags:
, , , , , ,
scanner-ui

Xen Server Escape Exploit News

Posted September 10, 2012    Jerome Diggs

In today’s ever expanding virtualized data center it’s critical to ensure hypervisors/host systems are properly secured and patched to prevent bleed over into often dense populations of the corporate infrastructure.  According to a recent blog post on Threatpost, French research firm VUPEN security has revealed exploit code that takes advantage of a vulnerability in Xen…

Tags:
, , , , , , , , , , , ,
img13

4 Tips to Identify, Patch & Report on the Oracle Java Vulnerability

Posted September 7, 2012    Jerome Diggs

Last week our security research team provided some very enlightening information on a nasty Oracle Java vulnerability that until recently was a zero-day.  Oracle provided a patch for the vulnerability found in advisory (CVE-2012-4681)  and as a follow-up to the blog post by our security research team we wanted to share with you some easy…

Tags:
, , , , ,
Java-Logo

Java Pwns Everyone…Again.

Posted August 30, 2012    BeyondTrust Research Team

Java has a nasty habit of getting you owned. This latest 0day is no exception to the long-lived trend of reliable Java-based exploitation. Here’s what you need to know: The current exploitation method being employed in the wild right now leverages two zero day flaws in Java. The first flaw leverages an implementation issue (logic bug) within ClassFinder.findClass(), which is only present in Java 7.

Tags:
, , , , , , , ,
blackholetoolkit1

BlackHole toolkit targets Microsoft XML Core Services flaw

Posted August 1, 2012    Sarah Lieber

Blackhole is a popular exploit kit used to inject malware onto PCs that visit an exploited site, or are redirected to such a site from another, compromised website.  As hackers get bolder they use these types of toolkits to compromise computer networks.  This allows less sophisticated individuals and organizations to compromise computer networks since these…

Tags:
, , , , , , , ,