Serious security flaw found in IE

*Important Information*
A serious security flaw is found in Internet Explorer today and everybody is been advised by 'MICROSOFT' not to use Internet Explorer for any confidential banking transactions until the new patch is released.
The new patch would be released at the earliest and Microsoft advices everybody to use the browser from their rivals until the patch is released.
Click on the below link to read:
http://news.bbc.co.uk/2/hi/technology/7784908.stm

I advise everybody to use the browser from their rivals, even after the the patch is released!
I couldn´t agree more
Maybe the browser was patched now so the data is not stolen by "someone" but to Microsoft instead when surfing MSDN
</cynism>
Markus

Similar Messages

Serious security flaw: Can't clear password cache in iPhone 3G Safari!

One of the reasons I want an iPhone is so I can access the online membership database for my church. I recently went into the AT&T store to see if I could get to this password-protected site on an iPhone 3G. This is one of those sites that pops up a Windows NT-style password prompt, as opposed to a standard web form password.
After logging on and making sure it worked, I opened a blank page, closed out the site, went into Settings > Clear History, Clear Cache, Clear Cookies. The site was gone from history. But just to be safe I typed the URL in again to make sure the password was cleared. Guess what? It went straight in without prompting for a password! This is very dangerous in any situation, but since this was a public phone in an AT&T store I had a real dilemma as I'm responsible for keeping this membership data private. Sure, after clearing history people would have to guess at the URL but I didn't want to risk that. The AT&T salesman could not figure out how to completely clear the password cache, so we ended up doing a Reset All Data.
Please tell me there's another solution! If not, this would be an unacceptable security issue because whether it's a membership database or online banking, if I lose my iPhone it could spell disaster.

Hello there....welcome to the world of iPhone - where some of us have been here since the launch of the first iPhone. Obviously you have just had your iPhone for a few days. You will get over the typing issues. Just practice. You will stop hitting the send button as soon as you get used to typing.
As for the contact issues you have - You delete groups of contacts - or all - in whatever software you use on your computer to organize your contacts. Outlook? You don't need to save your contacts to a sim card as you have them on your BIG SIMCARD you are using right now....your computer.
If someone steals your phone and tries to change the sim card, Apple/AT&T have the ability to lock the phone down so it can't be used. I've had it done when my first phone was stolen.
There ya go. Welcome to the board.
Please choose to get to know your phone better before proclaiming it less than perfect. THANKS!

Security Flaw on iPhone???

Critical iPhone security flaw found
Fortify Software, a security firm, has uncovered a critical security flaw in the Apple iPhone which could lead to phishing attacks.
Because the iPhone only displays the first few characters of a URL in its Safari web browser, phishers could easily hide a fraudulent URL at the end of a link without the user even knowing it.
Even worse, the iPhone connects the browser and the phone in such a way that it may be possible to embed scam telephone numbers into a site to make the phone automatically dial the scam number.
Let’s hope Apple is working on a fix for this one because that is some scary stuff. Now, if you input addresses yourself and use bookmarks, the chances of being affected by this are relatively minimal. That said, watch out for strange emails and Google results — you can’t always trust that either.
Anybody read this? Any comments or thoughts??? Valid?

It's hardly a new flaw since disguising URLs in links has been common practice for some time. However, while the browser does indeed only show a limited number of characters from the URL being opened (more if in landscape mode than portrait) to get to the URL at all the user would either have to enter it manually, or encounter it in an email or web page where the full URL should readily be discovered.
It seems probable to me that over time, security holes will be found as in all accessible and discoverable devices on the internet. Based on experience with Apple and MacOS, I would have confidence that genuine weaknesses found in the iPhone will benefit from security fixes as expeditiously as possible.

Need to solve serious security problem with Oracle Reports URL

As mentioned repeatedly on this forum, Oracle Reports allows serious security breaches that allow users to see reports that they did not generate -- it's easy to guess a legal URL by changing the getjobid parameter.
I've reviewed the JavaDocs to part of the rwrun.jar file and reviewed some of the example report plugins. This shows promise in helping to solve this security problem but critical pieces are missing.
1) The javadocs are accurate for only 10g (9.0.4) but not correct for 10g (10.1.2+), which we are currently using. I need access to the updated version of this javadoc.
2) Even with the updated version of the JavaDoc, I haven't found a class from which to inherit that would give me the opportunity to generate random jobid values, which then would effectively prevent users from guessing other jobid values, and thereby gaining access to other's reports (which in our cases, may contain sensitive information.
3) We have found that we can send the parameter=value of EXPIRATION=1 which helps protect such information, but this requires that every program which invokes a report be modified to add this parameter. It would be far better for the report server to be configured to use a java class we write that inherits from some rwrun.jar class that would by default, add the EXPIRATION=1 parameter.

Hi,
Thanks for our replies. I will ask to an administrator about this security problem, now I know it depends of a security parameter.
But I would know if it could be possible to hide the technical name of the query in the url. It could improve the security level of our reports in a first time in this way.
Thanks a lot,
JW.

BusinessObjects security flaw left users vulnerable to attack

Audit found this web article "BusinessObjects security flaw left users vulnerable to attack" http://searchsap.techtarget.com/news/2240025968/BusinessObjects-security-flaw-left-users-vulnerable-to-attack?asrc=EM_NLN_13056439&track=NL-137&ad=804092
and they were wondering if our installation of BusinessObjects was also vulnerable. I was not able to answer for sure, so I asked our BASIS team. They said that it is not clear from the article what components are actually affected or in what patch level this is corrected.
Does anyone know specifically where the security flaw is?
Thanks,
~Matt Strehlow

Hi Denis
thanks for the reply.
Are you absolutely sure that the passage should not be in the file any more?
I've checked now 3 different installations and I've even checked the axis2.xml in the war files I found (dated 04/22/2010) and they all do contain these two lines:
<parameter name="userName">admin</parameter>
<parameter name="password">axis2</parameter>
The installation were BOXI 3.1 SP3, meaning we used the "merged" installation files that include the SP3. One of the installations I checked has even Fix Pack 3.4 installed.
The only axis2.xml file I found that did not contain this passage was from a BODI installation...
am I missing something here?
thanks for any help!
MU

Security Flaw: Screen Saver Authentication

Hi,
I have found a security flaw, it exists in both Panther and Tiger. If a system has 2 accounts, the first account being active and locked through a screen saver. The second account (if administrator) can type their username/password in the authentication screen, and it will unlock the first account. This works if the first account is an administrator or not. Any administrator username/password will authenticate any other account from the screen saver authentication box. I have proven this on 2 machines, a D2.5 G5, and a 1.6 iMac G5.
Please contact me for further testing.

it's not a TECHNICAL flaw, it is however a logical flaw, yes.
Because admins are part of the sudoers files, one admin does have the permission to unlock another admin like that, the same as how when logged in with one account you can use another admin account to authorize the installation of software (why it's not necessary to be logged in with your admin account)
The behavior I suspect you desire is the behavior Windows uses, where when you use an admin account to unlock a computer, it logs out the user who locked it (assuming the admin isn't the one logged in).
I suggest you submit a feature request to Apple.

Adobe acknowledges critical security flaw in software...

Link to BBC article:
http://news.bbc.co.uk/2/hi/technology/10257411.stm
Adobe says the vulnerability potentially enables hackers to take control of affected computer systems.
Users running Windows, Macintosh or Linux might all be open to attack.
The company is working to fix the problem. In the meantime, users of Reader, Acrobat and Flash are advised to ensure their anti-virus software is up to date.
My antivirus software? God forbid... Is this some new kind of FUD?
What other sources have you found - perhaps even with more detailed info?

You can install the release candidate of flashplugin 10.1, I just changed the version and download url from the PKGBUILD in my abs tree and it seems to work. This version should not be vulnerable to the security flaw, according to the adobe site.
pkgname=flashplugin
_licensefile='Reader_Player_AIR_WWEULA-Combined-20080204_1313.pdf'
pkgver=10.1.rc7
pkgrel=1
pkgdesc='Adobe Flash Player'
url='http://get.adobe.com/flashplayer'
arch=('i686')
depends=('mozilla-common' 'libxt' 'gtk2' 'nss' 'curl')
replaces=('flashplugin-beta')
provides=('flashplayer')
license=('custom')
source=('http://download.macromedia.com/pub/labs/flashplayer10/flashplayer10_1_rc7_linux_060210.so.tar.gz'
"http://www.adobe.com/products/eulas/pdfs/${_licensefile}")
build() {
install -d -m755 ${pkgdir}/usr/lib/mozilla/plugins/ || return 1
install -m755 ${srcdir}/libflashplayer.so ${pkgdir}/usr/lib/mozilla/plugins/ || return 1
install -d -m755 ${pkgdir}/usr/share/licenses/${pkgname}/ || return 1
install -m644 "${_licensefile}" ${pkgdir}/usr/share/licenses/${pkgname}/LICENSE.pdf || return 1
md5sums=('e4cb4d26124605a54c3d498cc440368f'
'1636037610ee2aa35c5fb736a697b7e0')
Edit: I just made it so it works on my 32 bit system, 64 bit users will need to change the download url and md5sum.
Last edited by Ramses de Norre (2010-06-08 17:23:39)

Acrobat 9.2.0 Update Breaks Text Box Tool, Possibly Introduces a New Security Flaw.

Anyone have any ideas for this one?
Once we upgraded to version 9.2.0 (This is a major security release that fixes a Javascript security flaw) our text box tool no longer works the way we want it and crashes the program.
Try this:
1. Open any PDF document on a Windows XP SP3 computer with Adobe Acrobat 9.2.0.
2. Add the 'Text Box Tool' to the toolbar by right-clicking the toolbar and selecting 'MoreTools' then placing a checkbox next to the 'Text Box Tool'.
3. Click the 'Text Box Tool' on the toolbar and draw a new textbox anywhere on the PDF document.
4. Click out of the textbox to cancel typing mode, then single click back on the textbox that you just created.
5. Right-click the textbox that you created and select 'Properties..."
6. Under the 'Appearance' tab,
a. Select Style: No Border
b. Select Fill Color: No Color
c. Check the box 'Make Properties Default'
d. Click OK.
7. Click the Text Box Tool again, and draw another textbox (Since there is no border you will not see it but you will still be drawing a textbox).
8. Let go of the mouse when you are done drawing your textbox rectangle and the program will crash at this point.
Results:
1. "An internal error occurred." dialog box is displayed.
2. After clicking ok the following "Microsoft Visual C++ Runtime Library" dialog box is displayed:
"Runtime Error!
Program: C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat.exe
R6025
- pure virtual function call
3. After clicking ok another dialog box is displayed:
Error signature
AppName: acrobat.exe AppVer: 9.2.0.124 ModName: acrobat.dll Offset: 000509dd
4. The same error has occurred on all five computers that we tested the new version on.
Expected results: A new textbox is created and you may start typing in text (This was the behavior in version 9.1.3).
Additional Information
At times, we need to add information to PDF files (i.e missing dates, etc). We have always used the Text Box Tool to do this with no border, and with no fill color as this is the EASIEST and FASTEST way to add information to PDF files in a precise manner. We want the fill color to be transparent so that we can fit text in between and exactly on lines easier, and so that there is not a solid background box behind the text. We want no border because a border around text that needs to go on a line looks stupid. Up until version 9.2 this procedure worked fine. Now, the program will crash. Perhaps this even adds another security vulnerability if the crash could be exploited. We want to maintain security by patching Adobe to address the JavaScript vulnerability that was addressed in version 9.2.0, however, we are not able to update our users as the new version breaks the fundamental purpose that we use Adobe Acrobat for. We are stuck with the vulnerable version 9.1.3 until this problem is addressed. Disabling JavaScript is not an option either, as we use a Java plug-in on a daily basis.
Any thoughts would be great, I have attached screenshots of the errors.

The question still is not answered.
The problem continues in Acrobat 8.1.7 for Windows, even after updating toAcrobat 8.2.0. ( I can't comment on whether recent updates to Acrobat 9 fix the problem in Acrobat 9.)
The internal error after text insertion problem occurs even with PDF documents created in Acrobat 8, i.e., not only old versions of PDF files. We have the text box insertion icon in the toolbar, and the properties set to "no color" for the box and "0" width for the text box lines, as other commentators have noted.
The problem did not exist when Acrobat 8 Pro was installed, it was introduced by one of the updaters.
The main reason we use Acrobat, rather than much cheaper PDF-creation software, is to annotate PDF files (including inputting data into spaces in standard forms).
So justify the high price of Acrobat and fix the problem please, Adobe !

Security flaw-To use CSOM/Javascript code for Custom Office365(Sharepoint Online) application

Hi,
I've developed custom application in Office365(Sharepoint Online) using CSOM/Javascript. Security team from client side has been reported one major issue to the our application that any end user can comment our CSOM/Javascript code and bypass the validation
or can update / insert into sharepoint list item using developer tool/ Console in Google Chrome(F12 Key).
Also end user can write his own separate code in console of Google Chrome (Developer Tool / F12) and can update / insert into Sharepoint List.
Note:- End user has Add, Edit, View permission on all Sharepoint List.
This is one major security flaw of the Sharepoint/Office365 to use CSOM /Javascript for writing code, to overcome this issue could you please provide me some solution.
Your help would be greatly appreciated!!!
Looking for reply.
Thanks,
Mahesh Sherkar
Web: http://Mahesh-Sherkar.com
Email: [email protected]

Hello Paras,
Did you get any solution for this? I think your website was implemented this form. Can you please tell me the way how I can achieve it? I am also facing same problem. Please reply me as early as possible.
Thanks,
Mihir

Security Flaw: Since upgrading to iOS 8.3, I can by-pass passcode security by simply hitting RETURN on my bluetooth keyboard

I noticed when I typed my passcode incorrectly on my Logitech Fabric Skin Keyboard Folio, the iPad allowed me to log in. I checked again, but this time by just hitting RETURN key without entering any passcode, and again it allowed me to log in.
If I disconnect the keyboard, and use the soft keyboard on the iPad itself, it only allows the correct passcode.
Has anybody else seen this security flaw?
iPad Air
iOS 8.3

Please describe the problem in as much relevant detail as possible. The "etrecheck" fad hasn't made that step any less necessary. The better your description, the better the chance of a solution.
For example, if the computer is slow, which specific actions are slow? Is it slow all the time, or only sometimes? What other changes did you make, if any, just before it became slow? Have you seen any alerts or error messages? Have you done anything to try to fix it? Most importantly, do you have a current backup of all data? If the answer to the last question is "no," back up now. Ask if you need guidance. Do nothing else until you have a backup.

Security flaw in bt home hub 4 & bt home hub 5

there is a security flaw in the lastest two home hubs I recommend you avoid using these

That's a sweeping statement. Do you want tell us what it is?
EDIT: I see your other post
https://community.bt.com/t5/Other-BB-Queries/WPS-no-longer-gets-disabled-by-BT/td-p/776140/page/2
about the "security flaw" and I see you have also been answered.

FLASH SECURITY FLAW / FLASH 10.1 BETA

Re: Regarding the Flash security flaw, on the advice of an expert I installed ver 10.1 beta but now I can't stream audio. The players all say i need flash to play. But since I installed 10.1, don't I already HAVE Flash?

Hi, Yes you do have the Flash Player, however the 10.1 is a prerelease and is still a "work in progress" This will be the next version of Flash Player when the final release comes out which I don't know yet when that will be.
You can read about it here and if you want to Uninstall 10.1 and Install the shipped version, which is 10.0.45.2, page down until you see Uninstallers.
http://labs.adobe.com/downloads/flashplayer10.html
This is a thread that gives a little more info:
http://forums.adobe.com/thread/653155?tstart=0
Thanks,
eidnolb

Fatal Security Flaw in WRT54GS?

Sorry I don't have the hardware revision handy.
Firmware is 1.52.0. Model is WRT54GS.
I'm configured with WPA2-PSK/AES. Broadcasting my SSID. No MAC access filtering.
HTTPS access only to the config pages. Custom (not default) password. Remote management disabled.
Summary:
The router simply "forgot" its assigned SSID and reverted to broadcasting as "linksys".
It also ceased encrypting its broadcast.
I was able to log in and change it back. It retained many of the OTHER settings I had previously configured.
What causes this? Is it a known issue? Is there a fix?
Details:
Two days ago, I noticed my client (laptop) could no longer see the usual SSID that I connect to on my home network.
However, there was a new SSID in the area, named "linksys", broadcasting UNSECURED.
Coincidentally, this new "linksys" access point had the exact same signal strength that my usual access point typically had.
So, I connected to it, you know, just to see.
I was only able to access the config pages at my custom IP address (not at x.y.0.1), prefixed with the "https://" scheme identifier.
And it didn't prompt for a password. Hopefully because it recognized the cookie my browser still carried from the last time I logged in to it. But maybe because it had temporarily dropped ALL of its security measures...
It was definitely my router. Just, stripped of its usual encryption/authentication and its usual SSID.
So, I switched the SSID back to what it usually is.
And I turned the WPA2-PSK/AES encryption back on.
The router "remembered" my WPA2 passphrase, which it helpfully displayed to me as plaintext when I pulled down the "security mode" dropdown menu and selected "WPA2 Personal".
After re-configuring, it works as well as ever.
Is this a known security flaw in the WRT45GS? Because....it seems like a fatal one, as far as network security is concerned.
Is it limited to one firmware release? Is there a firmware upgrade to fix it?
(Again, I regret not having my hardware revision handy.)
Thanks.

Thanks for the reply.
Yeah, the initial configuration was done wired.
Subsequent reconfigurations were done wirelessly, on the encrypted wireless, connected via https.
Remote management was NEVER enabled (and remained disabled, even after the router's little spell of amnesia).
This particular router has been up and (mostly) stable for something like three years. For the past year, WPA2-PSK encryption ahs been enabled. The present WPA2-PSK passphrase is NOT the same as the old WEP key.
I'll assume (just for a moment) that nobody hacked the router. The only reason my router would be intresting for anyone to hack is simply because it's there. And there are half a dozen other WPA2-PSK networks and a handfull of WEP networks within shouting distance. And, if it was hacked from the outside, that would also indicate a "fatal security flaw" in the WRT54GS...
So, let's assume it just glitched out and forgot its own name for 12hrs.
Tell me more about what happens to NVRAM as it ages. Does it become less N(on) and more V(olatile) with time?
I know the router got hit by a storm-related power surge about 9 months ago. It was reset at that time, exhibited some strange behavior (not wanting to display the config web pages) and then it "settled down" after a day or two.
While it's performed fine since then, it may have sustained some subtle sort of damage at that time.
But no parameters were lost or altered in the NVRAM. And there was no obvious surge-type event to precipitate it now.
What's the life expectancy of these things anyway? Is this an early warning sign that I should upgrade to new hardware?

Security flaw in Femtocells

You should all read this.
http://www.reuters.com/article/2013/07/15/us-verizon-hacking-idUSBRE96E06X20130715

That's a sweeping statement. Do you want tell us what it is?
EDIT: I see your other post
https://community.bt.com/t5/Other-BB-Queries/WPS-no-longer-gets-disabled-by-BT/td-p/776140/page/2
about the "security flaw" and I see you have also been answered.

Security Flaw discovered in Droid 2 and Droid X

Read about it on UnWiredView.com
http://www.unwiredview.com/2010/10/15/verizon-motorola-droid-2-and-droid-x-security-flaw-discovered/

Is it working now?
If it affects more than one phone, there may be an outage in your area.

Serious security flaw found in IE

Similar Messages

Maybe you are looking for