OMFW 2008 reflections

Published: 2008-08-15
Last Updated: 2008-08-17 15:34:30 UTC
by Jim Clausing (Version: 2)
0 comment(s)

It was my great privilege to participate in OMFW this past Sunday afternoon in Baltimore.  Unfortunately, I wasn't able to stay for the rest of DFRWS, the program looked pretty good (more on that below) and the folks that I've talked to who were there said it was a great conference.  While I love SANS conferences, the academic in me also likes traditional conferences with peer-reviewed papers.  Back to OMFW.  AAron was able to bring together an outstanding group of folks interested in "memory forensics" and there was some spirited discussion among the participants along with some really outstanding talks/demos (hopefully, I'll be able to update this story soon with a link to the slides from the talks).  It was also great to be able to put faces to folks who until then had only been handles in IRC or names on e-mail/blog posts in the past.  Next year's DFRWS (and hopefully another OMFW) will be in Montreal.  Keep your eye on it, there is a lot of good research going on there and don't forget about the SANS Forensics Summit coming up in Vegas in October.

 

A couple of the interesting papers from DFRWS that I need to read:

http://dfrws.org/2008/proceedings/p26-dolan-gavitt.pdf

http://dfrws.org/2008/proceedings/p33-morgan.pdf

http://dfrws.org/2008/proceedings/p52-vanBaar.pdf

http://dfrws.org/2008/proceedings/p112-cohen.pdf

http://dfrws.org/2008/proceedings/p128-thonnard.pdf

 Update: (2008-08-17 15:30 UTC) The slides are here, and AAron has released volatility 1.3 (see Kevin's diary story).

 

0 comment(s)

WebEx ActiveX buffer overflow

Published: 2008-08-15
Last Updated: 2008-08-15 19:53:43 UTC
by Jim Clausing (Version: 1)
0 comment(s)

Last night, Cisco (who now owns WebEx) posted a bulletin about a buffer overflow in the WebEx Meeting Manager ActiveX control.  This one looks like it has the potential to be serious, so if you use WebEx, you are advised to read the Cisco advisory and update or set the killbit.

 

References:

http://www.cisco.com/warp/public/707/cisco-sa-20080814-webex.shtml

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2737 (not live yet)

Keywords: activex webex
0 comment(s)

Another MS update that may have escaped notice

Published: 2008-08-15
Last Updated: 2008-08-15 19:21:36 UTC
by Jim Clausing (Version: 1)
0 comment(s)

Those of you running automatic updates may have noticed more updates being downloaded this week than what we mentioned in our Black Tuesday overview.  Among the additional updates was the one descirbed in this advisory which had to do with killbits for 3rd party ActiveX components.  The following comment from the overview sums it up nicely, so I'll repeat it here (thanx, anonymous):

Microsoft also released 953839, which is an updated variant of MS08-032 (950760). This is the ActiveX Killbits update. This release only adds 3rd-party killbits to the list, so they didn't give it a bulletin. But you still want to deploy it . . .

0 comment(s)

Joomla user password reset vulnerability being actively exploited

Published: 2008-08-15
Last Updated: 2008-08-15 18:25:26 UTC
by Jim Clausing (Version: 1)
0 comment(s)

We've received reports from several readers (thanx, Ronaldo and anonymous) that they have seen successful exploitation of the Joomla user password reset vulnerability announced on 12 Aug (with an exploit posted to milw0rm at about the same time).  If you have not yet upgraded to 1.5.6, do so ASAP

 

References:

http://developer.joomla.org/security/news/241-20080801-core-password-remind-functionality.html

http://www.us-cert.gov/current/index.html#joomla_password_reset_vulnerability

http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-3681

Keywords: joomla
0 comment(s)

Comments

cwqwqwq
eweew<a href="https://www.seocheckin.com/edu-sites-list/">mashood</a>
WQwqwqwq[url=https://www.seocheckin.com/edu-sites-list/]mashood[/url]
dwqqqwqwq mashood
[https://isc.sans.edu/diary.html](https://isc.sans.edu/diary.html)
[https://isc.sans.edu/diary.html | https://isc.sans.edu/diary.html]
What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/

Diary Archives