Chercher :
Newsletter :  


Revues :
- Presse
- Presse FR
- Vidéos
- Twitter
- Secuobs





Sommaires :
- Tendances
- Failles
- Virus
- Concours
- Reportages
- Acteurs
- Outils
- Breves
- Infrastructures
- Livres
- Tutoriels
- Interviews
- Podcasts
- Communiques
- USBsploit
- Commentaires


Revue Presse:
- Tous
- Francophone
- Par mot clé
- Par site
- Le tagwall


Top bi-hebdo:
- Ensemble
- Articles
- Revue
- Videos
- Twitter
- Auteurs


Articles :
- Par mot clé
- Par auteur
- Par organisme
- Le tagwall


Videos :
- Toutes
- Par mot clé
- Par site
- Le tagwall


Twitter :
- Tous
- Par mot clé
- Par compte
- Le tagwall


Commentaires :
- Breves
- Virus
- Failles
- Outils
- Tutoriels
- Tendances
- Acteurs
- Reportages
- Infrastructures
- Interviews
- Concours
- Livres
- Communiques


RSS/XML :
- Articles
- Commentaires
- Revue
- Revue FR
- Videos
- Twitter


RSS SecuObs :
- sécurité
- exploit
- windows
- attaque
- outil
- réseau


RSS Revue :
- security
- microsoft
- windows
- hacker
- attack
- network


RSS Videos :
- curit
- security
- biomet
- metasploit
- biometric
- cking


RSS Twitter :
- security
- linux
- botnet
- attack
- metasploit
- cisco


RSS Comments :
- Breves
- Virus
- Failles
- Outils
- Tutoriels
- Tendances
- Acteurs
- Reportages
- Infrastructures
- Interviews
- Concours
- Livres
- Communiques


RSS OPML :
- Français
- International











Revue de presse francophone :
- Gigamon enrichit son offre pour renforcer l'efficacité des services de sécurité
- Gwen Rabier, Mobility for Business Nous visons 4000 visiteurs pour l'édition 2014
- SmartGird SmartCities 24 25 septembre 2014 CNIT - Paris La Défense
- Vigilance - Noyau Linux élévation de privilèges via ptrace SYSRET RIP, analysé le 07 07 2014
- Trend Micro renforce sa présence en Suisse
- Vigilance - McAfee Web Gateway obtention du haché de mots de passe, analysé le 18 07 2014
- Safran sensibilise ses collaborateurs à la protection de l'information avec un serious game
- 4 bonnes raisons pour équiper sa tablette Android du contrôle parental Xooloo
- Dell SonicWALL intègre le catalogue ACTN
- La nouvelle étude Ponemon Institute-Informatica identifie les problématiques et risques majeurs liés à la sécurité des données
- Dimension Data annonce les nominations de Delphine Bosramier au poste de ITO Business Development Manager et de Nicolas Renaud au poste de Responsable du département Cloud
- Les entreprises lyonnaises ont décidément le vent en poupe
- Vigilance - Apache httpd déni de service via mod_cgid, analysé le 17 07 2014
- Vigilance - Drupal Password Policy multiples vulnérabilités, analysé le 17 07 2014
- Vigilance - McAfee Application Control exécution de code, analysé le 03 07 2014

Dernier articles de SecuObs :
- Renaud Bidou (Deny All): "L'innovation dans le domaine des WAFs s'oriente vers plus de bon sens et d'intelligence, plus de flexibilité et plus d'ergonomie"
- Mises à jour en perspective pour le système Vigik
- Les russes ont-ils pwn le système AEGIS ?
- Le ministère de l'intérieur censure une conférence au Canada
- Saut d'air gap, audit de firmware et (in)sécurité mobile au programme de Cansecwest 2014
- GCHQ: Le JTRIG torpille Anonymous qui torpille le JTRIG (ou pas)
- #FIC2014: Entrée en territoire inconnu
- Le Sénat investit dans les monnaies virtuelles
- #LPM2013: Un nouvel espoir ?
- L'ANSSI durcit le ton

Revue de presse internationale :
- The Science of Pickles Kosher Dill Current Activity makereducation
- Funny Facebook video scam
- 3 in 10 consumers dont trust retailers with their data
- BBB Barbot BeagleBoneBlack TXInstruments BeagleBoardOrg
- IT security training Be proactive
- Whitepaper BYOD security that works
- IT security training Be proactive
- Artist Lucy McRae on preparing the human body for SpaceTravel ArtTuesday
- Make Your Own Hydroponic System With 2 Liter Soda Bottles NatureAndTechnology
- B-Sides Cleveland - Threat Models that Exercise your SIEM and Incident Response J Wolfgang Goerlich and Nick Jacob
- B-Sides Cleveland - Fun with Dr. Brown
- B-Sides Cleveland - Malware Evolution and Epidemiology
- B-Sides Cleveland - Plunder, Pillage and Print - The art of leverage multifunction printers during penetration testing
- B-Sides Cleveland - Attacking and Defending Full Disk Encryption
- B-Sides Cleveland - Phishing Like a Monarch With King Phisher Brandon Geise and Spencer McIntyre

Annuaire des videos
- FUZZING ON LINE PART THREE
- Official Maltego tutorial 5 Writing your own transforms
- Official Maltego tutorial 6 Integrating with SQL DBs
- Official Maltego tutorial 3 Importing CSVs spreadsheets
- install zeus botnet
- Eloy Magalhaes
- Official Maltego tutorial 1 Google s websites
- Official Maltego tutorial 4 Social Networks
- Blind String SQL Injection
- backdoor linux root from r57 php shell VPS khg crew redc00de
- How To Attaque Pc With Back Track 5 In Arabique
- RSA Todd Schomburg talks about Roundup Ready lines available in 2013
- Nessus Diagnostics Troubleshooting
- Panda Security Vidcast Panda GateDefender Performa Parte 2 de 2
- MultiPyInjector Shellcode Injection

Revue Twitter
- RT @fpalumbo: Cisco consistently leading the way ? buys vCider to boost its distributed cloud vision #CiscoONE
- @mckeay Looks odd... not much to go on (prob some slideshow/vid app under Linux)
- [SuggestedReading] Using the HTML5 Fullscreen API for Phishing Attacks
- RT @BrianHonan: Our problems are not technical but cultural. OWASP top 10 has not changed over the years @joshcorman #RSAC
- RT @mikko: Wow. Apple kernels actually have a function called PE_i_can_has_debugger:
- [Blog Spam] Metasploit and PowerShell payloads
- PinkiePie Strikes Again, Compromises Google Chrome in Pwnium Contest at Hack in the Box: For the second time thi...
- @mikko @fslabs y'all wldn't happen to have lat/long data sets for other botnets, wld you? Doing some research (free/open info rls when done)
- RT @nickhacks: Want to crash a remote host running Snow Leopard? Just use: nmap -P0 -6 --script=targets-ipv6-multicast-mld #wishiwaskidding
- An inexpensive proxy service called is actually a front for #malware distribution -

Mini-Tagwall
Revue de presse : security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone

+ de mots clés pour la revue de presse

Annuaires des videos : curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit

+ de mots clés pour les videos

Revue Twitter : security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall

+ de mots clés pour la revue Twitter

Top bi-hebdo des articles de SecuObs
- [IDS Snort Windows – Partie 1] Introduction aux IDS et à SNORT
- [IDS Snort Windows – Partie 2] Installation et configuration
- [Ubiquiti SuperRange 300 mW - Partie 2] Utilisation avec Aircrack-ng
- USBDumper 2 nouvelle version nouvelles fonctions !
- IronWASP une plate-forme d'audit Web résolument modulaire
- WPA Cracker un cluster en ligne de 400 CPU et un dictionnaire de 135 millions d'entrées pour casser, ou pas, WPA/WPA2-PSK en 20 minutes
- [Ettercap – Partie 2] Ettercap par l'exemple - Man In the Middle et SSL sniffing
- Yersinia, un environnement de travail pour les attaques sur le layer 2
- EFIPW récupère automatiquement le mot de passe BIOS EFI des Macbook Pro avec processeurs Intel
- [Sécuriser un réseau sans fil - Partie 3] Récapitulatif et configuration du point d'accès

Top bi-hebdo de la revue de presse
- StackScrambler and the Tale of a Packet Parsing Bug

Top bi-hebdo de l'annuaire des videos
- Water & Dust proof biometric fingerprint IP65 Casing from ACTAtek
- Comment creer un server botnet!!!!(Réseau de pc zombies)

Top bi-hebdo de la revue Twitter

Top des articles les plus commentés
- [Metasploit 2.x – Partie 1] Introduction et présentation
- Microsoft !Exploitable un nouvel outil gratuit pour aider les développeurs à évaluer automatiquement les risques
- Webshag, un outil d'audit de serveur web
- Les navigateurs internet, des mini-systèmes d’exploitation hors de contrôle ?
- Yellowsn0w un utilitaire de déblocage SIM pour le firmware 2.2 des Iphone 3G
- CAINE un Live[CD|USB] pour faciliter la recherche légale de preuves numériques de compromission
- Nessus 4.0 placé sous le signe de la performance, de l'unification et de la personnalisation
- [Renforcement des fonctions de sécurité du noyau Linux – Partie 1] Présentation
- [IDS Snort Windows – Partie 1] Introduction aux IDS et à SNORT
- Origami pour forger, analyser et manipuler des fichiers PDF malicieux



[Message Precedent sur la mailing][Message Suivant sur la mailing][Precedent dans le fil][Prochain dans le fil][Index par Date][Index par fil] [SA34451] Sun Java JDK / JRE Multiple Vulnerabilities


Secunia is pleased to announce the release of the annual Secunia
report for 2008.

Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: link://[click] Stay Secure, Secunia

TITLE: Sun Java JDK / JRE Multiple Vulnerabilities

SECUNIA ADVISORY ID: SA34451

VERIFY ADVISORY: link://[click]

DESCRIPTION: Some vulnerabilities have been reported in Sun Java, which can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), or potentially compromise a user's system.

1) An error while initialising LDAP connections can be exploited to render the LDAP service unresponsive.

2) An error in the JRE LDAP client implementation can be exploited to load and execute arbitrary code via specially crafted data received from a malicious LDAP server.

3) An integer overflow vulnerability in JRE when unpacking applets and in Java Web Start applications using the "unpack200" JAR unpacking utility can be exploited to potentially execute arbitrary code.

4) An error in JRE when unpacking applets and in Java Web Start applications using the "unpack200" JAR unpacking utility can be exploited to cause a buffer overflow and potentially execute arbitrary code.

5) Two errors when storing and processing temporary font files can be exploited by an untrusted applet or a Java Web Start application to consume an overly large amount of disk space.

6) An error in the Java Plug-in when deserializing applets can be exploited to e.g. read, write, or execute local files.

7) The Java Plug-in allows JavaScript code loaded from the local system to connect to arbitrary local ports. This can be exploited in combination with cross-site scripting attacks to access normally restricted local ports.

8) The Java Plug-in allows applets to run in earlier versions of JRE if approved by the user. This can be exploited to trick a user into loading a malicious applet into an old and potentially vulnerable JRE version.

9) An error in the Java Plug-in when processing crossdomain.xml files can be exploited by an untrusted applet to connect to arbitrary domains providing a crossdomain.xml file.

10) An error in the Java Plug-in can be exploited by a signed applet to alter the contents of the security dialog and trick a user into trusting the applet.

11) An error in the JRE virtual machine when generating code can be exploited to e.g. read, write, or execute local files.

NOTE: This vulnerability only affects JDK and JRE 6 Update 12 and earlier for the Solaris SPARC platform.

12) An error in JRE when processing PNG images can be exploited by an untrusted Java Web Start application to cause a buffer overflow and potentially execute arbitrary code.

13) An error in JRE when processing GIF images can be exploited by an untrusted Java Web Start application to cause a buffer overflow and potentially execute arbitrary code.

14) An error in JRE when processing GIF images can be exploited by an untrusted applet or an untrusted Java Web Start application to cause a buffer overflow and potentially execute arbitrary code.

15) An error in JRE when processing fonts can be exploited by an untrusted applet or an untrusted Java Web Start application to cause a buffer overflow and potentially execute arbitrary code.

16) An unspecified error in the JRE HTTP server implementation can be exploited to render a JAX-WS service endpoint unresponsive.

Please see the vendor advisories for details on affected products and versions.

SOLUTION: Update to a fixed version.

JDK and JRE 6 Update 13: link://[click] JDK and JRE 5.0 Update 18: link://[click] Java SE for Business SDK and JRE 1.4.2_20: link://[click] SDK and JRE 1.3.1_25 (for customers with Solaris 8 and Vintage Support Offering support contracts): link://[click] NOTE: Java SE SDK and JRE 1.4.2 have reached Sun End of Service Life (EOSL). Upgrade to the latest Java SE release or migrate to Java SE for Business.

PROVIDED AND/OR DISCOVERED BY: 1, 2, 6, 7, 8, 11, 16) Reported by the vendor.

3, 4) The vendor credits regenrecht working with iDefense and Chris Evans of Google.

5) The vendor credits Marc Schoenefeld.

9) The vendor credits Gregory Fleischer.

10) The vendor credits Michael Scheirl.

12, 13, 14) The vendor credits regenrecht working with iDefenese.

15) The vendor credits Sean Larsson, iDefense.



ORIGINAL ADVISORY: Sun: link://[click] link://[click] link://[click] link://[click] link://[click] link://[click] link://[click]

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: link://[click]

Definitions: (Criticality, Where etc.) link://[click]

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link.

Secunia NEVER sends attached files with advisories.

Secunia does not advise people to install third party patches, only use those supplied by the vendor.




Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure





SecuToolBox :

Mini-Tagwall des articles publiés sur SecuObs :

Mini-Tagwall de l'annuaire video :

Mini-Tagwall des articles de la revue de presse :

Mini-Tagwall des Tweets de la revue Twitter :