Chercher :
Newsletter :  


Revues :
- Presse
- Presse FR
- Vidéos
- Twitter
- Secuobs





Sommaires :
- Tendances
- Failles
- Virus
- Concours
- Reportages
- Acteurs
- Outils
- Breves
- Infrastructures
- Livres
- Tutoriels
- Interviews
- Podcasts
- Communiques
- USBsploit
- Commentaires


Revue Presse:
- Tous
- Francophone
- Par mot clé
- Par site
- Le tagwall


Top bi-hebdo:
- Ensemble
- Articles
- Revue
- Videos
- Twitter
- Auteurs


Articles :
- Par mot clé
- Par auteur
- Par organisme
- Le tagwall


Videos :
- Toutes
- Par mot clé
- Par site
- Le tagwall


Twitter :
- Tous
- Par mot clé
- Par compte
- Le tagwall


Commentaires :
- Breves
- Virus
- Failles
- Outils
- Tutoriels
- Tendances
- Acteurs
- Reportages
- Infrastructures
- Interviews
- Concours
- Livres
- Communiques


RSS/XML :
- Articles
- Commentaires
- Revue
- Revue FR
- Videos
- Twitter


RSS SecuObs :
- sécurité
- exploit
- windows
- attaque
- outil
- microsoft


RSS Revue :
- security
- microsoft
- windows
- hacker
- attack
- network


RSS Videos :
- curit
- security
- biomet
- metasploit
- biometric
- cking


RSS Twitter :
- security
- linux
- botnet
- attack
- metasploit
- cisco


RSS Comments :
- Breves
- Virus
- Failles
- Outils
- Tutoriels
- Tendances
- Acteurs
- Reportages
- Infrastructures
- Interviews
- Concours
- Livres
- Communiques


RSS OPML :
- Français
- International











Revue de presse francophone :
- Vigilance - Python requests manipulation de Cookie, analysé le 30 03 2015
- Vigilance - TYPO3 Neos accès en lecture et écriture, analysé le 30 03 2015
- Japanese one-click fraudsters give old trick a second chance
- Tech Data lance sa première édition du Sympo Tech Tour
- Sophos intégre le Wi-Fi 802.11ac dans son Firewall UTM
- Dell annonce le PowerEdge R930
- F-Secure Les vulnérabilités logicielles continuent de fournir des exploits pour les criminels
- Fortinet annonce un accord de rachat de Meru Networks
- Tour d'horizon des solutions ESET
- Voyage au c?ur du centre nerveux d'ESET
- 15 juin de 18h00 à 20h00 - Lundi de l'IE Comprendre la cryptologie et ses applications
- HP apporte de nouvelles fonctionnalités de stockage pour le cloud computing à la distribution OpenStack Kilo
- Qualys SCAP Auditor 1.2 est désormais certifié NIST
- Ikoula lance le nouveau Cloud Hybrid Toolbox avec la technologie UShareSoft
- Cloudwatt rejoint la première place de marché internationale consacrée au Cloud

Dernier articles de SecuObs :
- Renaud Bidou (Deny All): "L'innovation dans le domaine des WAFs s'oriente vers plus de bon sens et d'intelligence, plus de flexibilité et plus d'ergonomie"
- Mises à jour en perspective pour le système Vigik
- Les russes ont-ils pwn le système AEGIS ?
- Le ministère de l'intérieur censure une conférence au Canada
- Saut d'air gap, audit de firmware et (in)sécurité mobile au programme de Cansecwest 2014
- GCHQ: Le JTRIG torpille Anonymous qui torpille le JTRIG (ou pas)
- #FIC2014: Entrée en territoire inconnu
- Le Sénat investit dans les monnaies virtuelles
- #LPM2013: Un nouvel espoir ?
- L'ANSSI durcit le ton

Revue de presse internationale :
- Lesser known tricks for IDA configuration
- Trying to rip a stream from web, can someone point out where is my mistake s
- Programmable Pump Keeps Its Stick On The Ice
- Taxpayers trapped by IRS failure to secure return data
- Hackaday Prize Entry A Better DIY CT Scanner
- Third Party Vendors Are Your Weakest Links
- Scapy Kivy Tutorial 16 Port Scan -1 Un threaded
- Ubuntu Debian FUSE Privilege Escalation CVE-2015-3202
- the-irs-has-been-subject-to-a-massive-data-breach-by-hackers
- The Most Powerful Bitcoin Mining Rig Yet
- Short Takes Daily What s going on in the world of Microsoft for Friday, May 29, 2015
- READER SURVEY What are your plans for Windows Server 2003
- Silk Road s Ross Ulbricht sentenced to life in prison, without parole
- Avast Data Drives New Analytics Engine
- Analysis of Yemen Cyber Army data dump

Annuaire des videos
- FUZZING ON LINE PART THREE
- Official Maltego tutorial 5 Writing your own transforms
- Official Maltego tutorial 6 Integrating with SQL DBs
- Official Maltego tutorial 3 Importing CSVs spreadsheets
- install zeus botnet
- Eloy Magalhaes
- Official Maltego tutorial 1 Google s websites
- Official Maltego tutorial 4 Social Networks
- Blind String SQL Injection
- backdoor linux root from r57 php shell VPS khg crew redc00de
- How To Attaque Pc With Back Track 5 In Arabique
- RSA Todd Schomburg talks about Roundup Ready lines available in 2013
- Nessus Diagnostics Troubleshooting
- Panda Security Vidcast Panda GateDefender Performa Parte 2 de 2
- MultiPyInjector Shellcode Injection

Revue Twitter
- RT @fpalumbo: Cisco consistently leading the way ? buys vCider to boost its distributed cloud vision #CiscoONE
- @mckeay Looks odd... not much to go on (prob some slideshow/vid app under Linux)
- [SuggestedReading] Using the HTML5 Fullscreen API for Phishing Attacks
- RT @BrianHonan: Our problems are not technical but cultural. OWASP top 10 has not changed over the years @joshcorman #RSAC
- RT @mikko: Wow. Apple kernels actually have a function called PE_i_can_has_debugger:
- [Blog Spam] Metasploit and PowerShell payloads
- PinkiePie Strikes Again, Compromises Google Chrome in Pwnium Contest at Hack in the Box: For the second time thi...
- @mikko @fslabs y'all wldn't happen to have lat/long data sets for other botnets, wld you? Doing some research (free/open info rls when done)
- RT @nickhacks: Want to crash a remote host running Snow Leopard? Just use: nmap -P0 -6 --script=targets-ipv6-multicast-mld #wishiwaskidding
- An inexpensive proxy service called is actually a front for #malware distribution -

Mini-Tagwall
Revue de presse : security, microsoft, windows, hacker, attack, network, vulnerability, google, exploit, malware, internet, remote, iphone

+ de mots clés pour la revue de presse

Annuaires des videos : curit, security, biomet, metasploit, biometric, cking, password, windows, botnet, defcon, tutorial, crypt, xploit

+ de mots clés pour les videos

Revue Twitter : security, linux, botnet, attack, metasploit, cisco, defcon, phish, exploit, google, inject, server, firewall

+ de mots clés pour la revue Twitter

Top bi-hebdo des articles de SecuObs
- [Ettercap – Partie 2] Ettercap par l'exemple - Man In the Middle et SSL sniffing
- Hyperion, chiffrement AES-128 et mises en conteneurs de fichiers Portable Executable 32-bit
- [Sécurité et PHP - Partie 4] Remote PHP Vulnerabilty Scanner
- [Infratech - release] version 0.6 de Bluetooth Stack Smasher
- Mises à jour en perspective pour le système Vigik
- Les russes ont-ils pwn le système AEGIS ?
- [Ettercap – Partie 1] Introduction et rappels
- [Ettercap – Partie 4] Contre-mesures, conclusion et webographie
- Sipvicious, un outil d’audit pour SIP
- [(in)Sécurité du protocole HTTPS par Sysun Technologies – partie 1] Introduction à HTTPS

Top bi-hebdo de la revue de presse
- Tanguy de Coatpont, Kaspersky Lab Sécurité informatique, l'approche proactive reste la meilleure défense
- Log Results of Successful IIS6 WebDAV Zero Day Attacks
- Analyzing E-mail .Msg files and Attachments without Outlook
- 5 Reasons HTTPOnly won't save you
- Vigilance - EMC NetWorker obtention d'information via nsradmin, analysé le 30 07 2013
- Netsparker Web Application Security Scanner 3.5 Features Highlight
- 20 Mai Paris conférence GCIC L'Intelligence Economique d'Entreprise au défi du numérique
- 18 juin 2015 Cnam à  Paris - Colloque ENSAE Alumni Le Individu, données et société connectée Opportunités, risques et confiance
- Sécurité informatique les Métiers en Or et les métiers en danger selon l'ILV
- CLUSIF - Enquête sur l'utilisation des référentiels GT Sécurité SCADA

Top bi-hebdo de l'annuaire des videos
- Cybercrime series Part 2 of 4 Wireless ID Theft
- YouTube wireshark wireless password sniffing
- Black Hat USA 2010 TitanMist Your First Step to Reversing Nirvana 1
- Reverse SSH Tunnel Metasploit Pivoting Tut
- Backtrack 5r3 Armitage Metasploit
- TUTO Andromeda Botnet Configuration
- Tutoriel Supprimer Cacaoweb Botnet
- Comment creer un server botnet!!!!(Réseau de pc zombies)
- Avoir des donuts illimit s sur le jeu Simpsons Springfield
- install zeus botnet

Top bi-hebdo de la revue Twitter
- Cisco's 2009 Annual Security Report - - (NB: I am emp by Cisco)
- RT @id084895: PBX #hacking moves into the professional domain as arrests stack up (a golden oldie #security)
- Released pvefindaddr v2.0.13 - - minor updates
- PinkiePie Strikes Again, Compromises Google Chrome in Pwnium Contest at Hack in the Box: For the second time thi...
- RT @hdmoore: Happy 6th Birthday Metasploit.com! -
- crack.pl: md5/sha1 cracker/ rainbowtable generator
- RT @WTFuzz: I just wrote a (rather lengthy) blog post on a few java vulnerabilities, patched in java 1.6.19. Feel f ...
- Sexy piece of work at milw0rm - YourTube = 2.0 Remote SQL Database Disclosure -
- RT @ Sniffing Browser History with NO Javascript! (via @msuiche)
- @biosshadow oh snap! Have a few beers at the flying saucer for me! Their kiosk has sqli you can print free beer tickets... or so I heard

Top des articles les plus commentés
- [Metasploit 2.x – Partie 1] Introduction et présentation
- Microsoft !Exploitable un nouvel outil gratuit pour aider les développeurs à évaluer automatiquement les risques
- Webshag, un outil d'audit de serveur web
- Les navigateurs internet, des mini-systèmes d’exploitation hors de contrôle ?
- Yellowsn0w un utilitaire de déblocage SIM pour le firmware 2.2 des Iphone 3G
- CAINE un Live[CD|USB] pour faciliter la recherche légale de preuves numériques de compromission
- Nessus 4.0 placé sous le signe de la performance, de l'unification et de la personnalisation
- [Renforcement des fonctions de sécurité du noyau Linux – Partie 1] Présentation
- [IDS Snort Windows – Partie 1] Introduction aux IDS et à SNORT
- Origami pour forger, analyser et manipuler des fichiers PDF malicieux



[Message Precedent sur la mailing][Message Suivant sur la mailing][Precedent dans le fil][Prochain dans le fil][Index par Date][Index par fil] [SA34451] Sun Java JDK / JRE Multiple Vulnerabilities


Secunia is pleased to announce the release of the annual Secunia
report for 2008.

Highlights from the 2008 report: * Vulnerability Research * Software Inspection Results * Secunia Research Highlights * Secunia Advisory Statistics Request the full 2008 Report here: link://[click] Stay Secure, Secunia

TITLE: Sun Java JDK / JRE Multiple Vulnerabilities

SECUNIA ADVISORY ID: SA34451

VERIFY ADVISORY: link://[click]

DESCRIPTION: Some vulnerabilities have been reported in Sun Java, which can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), or potentially compromise a user's system.

1) An error while initialising LDAP connections can be exploited to render the LDAP service unresponsive.

2) An error in the JRE LDAP client implementation can be exploited to load and execute arbitrary code via specially crafted data received from a malicious LDAP server.

3) An integer overflow vulnerability in JRE when unpacking applets and in Java Web Start applications using the "unpack200" JAR unpacking utility can be exploited to potentially execute arbitrary code.

4) An error in JRE when unpacking applets and in Java Web Start applications using the "unpack200" JAR unpacking utility can be exploited to cause a buffer overflow and potentially execute arbitrary code.

5) Two errors when storing and processing temporary font files can be exploited by an untrusted applet or a Java Web Start application to consume an overly large amount of disk space.

6) An error in the Java Plug-in when deserializing applets can be exploited to e.g. read, write, or execute local files.

7) The Java Plug-in allows JavaScript code loaded from the local system to connect to arbitrary local ports. This can be exploited in combination with cross-site scripting attacks to access normally restricted local ports.

8) The Java Plug-in allows applets to run in earlier versions of JRE if approved by the user. This can be exploited to trick a user into loading a malicious applet into an old and potentially vulnerable JRE version.

9) An error in the Java Plug-in when processing crossdomain.xml files can be exploited by an untrusted applet to connect to arbitrary domains providing a crossdomain.xml file.

10) An error in the Java Plug-in can be exploited by a signed applet to alter the contents of the security dialog and trick a user into trusting the applet.

11) An error in the JRE virtual machine when generating code can be exploited to e.g. read, write, or execute local files.

NOTE: This vulnerability only affects JDK and JRE 6 Update 12 and earlier for the Solaris SPARC platform.

12) An error in JRE when processing PNG images can be exploited by an untrusted Java Web Start application to cause a buffer overflow and potentially execute arbitrary code.

13) An error in JRE when processing GIF images can be exploited by an untrusted Java Web Start application to cause a buffer overflow and potentially execute arbitrary code.

14) An error in JRE when processing GIF images can be exploited by an untrusted applet or an untrusted Java Web Start application to cause a buffer overflow and potentially execute arbitrary code.

15) An error in JRE when processing fonts can be exploited by an untrusted applet or an untrusted Java Web Start application to cause a buffer overflow and potentially execute arbitrary code.

16) An unspecified error in the JRE HTTP server implementation can be exploited to render a JAX-WS service endpoint unresponsive.

Please see the vendor advisories for details on affected products and versions.

SOLUTION: Update to a fixed version.

JDK and JRE 6 Update 13: link://[click] JDK and JRE 5.0 Update 18: link://[click] Java SE for Business SDK and JRE 1.4.2_20: link://[click] SDK and JRE 1.3.1_25 (for customers with Solaris 8 and Vintage Support Offering support contracts): link://[click] NOTE: Java SE SDK and JRE 1.4.2 have reached Sun End of Service Life (EOSL). Upgrade to the latest Java SE release or migrate to Java SE for Business.

PROVIDED AND/OR DISCOVERED BY: 1, 2, 6, 7, 8, 11, 16) Reported by the vendor.

3, 4) The vendor credits regenrecht working with iDefense and Chris Evans of Google.

5) The vendor credits Marc Schoenefeld.

9) The vendor credits Gregory Fleischer.

10) The vendor credits Michael Scheirl.

12, 13, 14) The vendor credits regenrecht working with iDefenese.

15) The vendor credits Sean Larsson, iDefense.



ORIGINAL ADVISORY: Sun: link://[click] link://[click] link://[click] link://[click] link://[click] link://[click] link://[click]

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: link://[click]

Definitions: (Criticality, Where etc.) link://[click]

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link.

Secunia NEVER sends attached files with advisories.

Secunia does not advise people to install third party patches, only use those supplied by the vendor.




Archives de la liste de diffusion Secunia
Archives de la liste de diffusion Full Disclosure





SecuToolBox :

Mini-Tagwall des articles publiés sur SecuObs :

Mini-Tagwall de l'annuaire video :

Mini-Tagwall des articles de la revue de presse :

Mini-Tagwall des Tweets de la revue Twitter :