lepthien.eu » Security

Mint Installation durch SSL absichern

Jimmy — Wed, 23 Jun 2010 12:59:37 +0000

Ich hatte ja bereits in einem anderen Beitrag beschrieben, wie man sein WordPress Login via SSL Verschlüsselung sicher macht. Sicher kennen viele von euch das Statistik-Tool Mint, welches ebenfalls via Webinterface erreichbar ist und somit auch über https angesprochen werden sollte, damit ihr eure Logindaten nicht im Klartext durch das böse Internet schickt. Dazu müsst ihr einfach die .htaccess Datei in eurem /mint Verzeichnis durch folgenden Eintrag ergänzen. Einfach oben in die Datei einfügen, danach sollte jeder Aufruf der Mint Installation automatisch von http auf https umgeleitet werden:

RewriteEngine On
RewriteCond %{SERVER_PORT}     !^443$
RewriteRule (.*)  https://%{SERVER_NAME}%{REQUEST_URI}

Copyright © 2010 by lepthien.eu Dieser Feed ist nur für den persönlichen und nicht-kommerziellen Gebrauch bestimmt. Eine Verwendung dieses Feeds auf anderen Webseiten verstößt gegen das Urheberrecht.

APPLE-SA-2010-04-14-1 Security Update 2010-003

Jimmy — Wed, 14 Apr 2010 20:34:36 +0000

Apple hat soeben ein Sicherheitsupdate für 10.5.8 und 10.6.3 veröffentlicht. Das ganze könnt ihr über die Softwareaktualisierung einspielen:

Security Update 2010-003 is now available and addresses the
following:

ATS
CVE-ID: CVE-2010-1120
Available for: Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.3, Mac OS X Server v10.6.3
Impact: Viewing or downloading a document containing a maliciously
crafted embedded font may lead to arbitrary code execution
Description: An unchecked index issue exists in Apple Type Services’
handling of embedded fonts. Viewing or downloading a document
containing a maliciously crafted embedded font may lead to arbitrary
code execution. This issue is addressed through improved index
checking. Credit to Charlie Miller working with TippingPoint’s Zero
Day Initiative for reporting this issue.

Security Update 2010-003 may be obtained from the Software Update
pane in System Preferences, or Apple’s Software Downloads web site:
http://www.apple.com/support/downloads/

For Mac OS X v10.6.3 and Mac OS X Server v10.6.3
The download file is named: SecUpd2010-003Snow.dmg
Its SHA-1 digest is: aa1579322ef07a1637b35a3ac02612ca5a22a74a

For Mac OS X v10.5.8
The download file is named: SecUpd2010-003.dmg
Its SHA-1 digest is: 3f82f68f5a96a0c103fcc3ad88da9451b48def08

For Mac OS X Server v10.5.8
The download file is named: SecUpdSrvr2010-003.dmg
Its SHA-1 digest is: bc299a8932d02cf8e10bdb82ca6f21908d9ba50a

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

APPLE-SA-2010-03-11-1 Safari 4.0.5

Jimmy — Fri, 12 Mar 2010 07:15:29 +0000

Folgendes hat Apple über die Security Announce Mailinglist bekannt gegeben.

Safari 4.0.5 is now available and addresses the following:

ColorSync
CVE-ID: CVE-2010-0040
Available for: Windows 7, Vista, XP
Impact: Viewing a maliciously crafted image with an embedded color
profile may lead to an unexpected application termination or
arbitrary code execution
Description: An integer overflow, that could result in a heap buffer
overflow, exists in the handling of images with an embedded color
profile. Opening a maliciously crafted image with an embedded color
profile may lead to an unexpected application termination or
arbitrary code execution. The issue is addressed by performing
additional validation of color profiles. This issue does not affect
Mac OS X systems. Credit to Sebastien Renaud of VUPEN Vulnerability
Research Team for reporting this issue.

Weiterlesen ▼

ImageIO
CVE-ID: CVE-2009-2285
Available for: Windows 7, Vista, XP
Impact: Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution
Description: A buffer underflow exists in ImageIO’s handling of TIFF
images. Viewing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution. This
issue is addressed through improved bounds checking. For Mac OS X
v10.6 systems, this issue is addressed in Mac OS X v10.6.2. For Mac
OS X v10.5 systems, this issue is addressed in Security Update
2010-001.

ImageIO
CVE-ID: CVE-2010-0041
Available for: Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may result in sending
data from Safari’s memory to the website
Description: An uninitialized memory access issue exists in
ImageIO’s handling of BMP images. Visiting a maliciously crafted
website may result in sending data from Safari’s memory to the
website. This issue is addressed through improved memory handling and
additional validation of BMP images. Credit to Matthew ‘j00ru’
Jurczyk of Hispasec for reporting this issue.

ImageIO
CVE-ID: CVE-2010-0042
Available for: Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may result in sending
data from Safari’s memory to the website
Description: An uninitialized memory access issue exists in
ImageIO’s handling of TIFF images. Visiting a maliciously crafted
website may result in sending data from Safari’s memory to the
website. This issue is addressed through improved memory handling and
additional validation of TIFF images. Credit to Matthew ‘j00ru’
Jurczyk of Hispasec for reporting this issue.

ImageIO
CVE-ID: CVE-2010-0043
Available for: Windows 7, Vista, XP
Impact: Processing a maliciously crafted TIFF image may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in the handling of
TIFF images. Processing a maliciously crafted TIFF image may lead to
an unexpected application termination or arbitrary code execution.
This issue is addressed through improved memory handling. Credit to
Gus Mueller of Flying Meat for reporting this issue.

PubSub
CVE-ID: CVE-2010-0044
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting or updating a feed may result in a cookie being
set, even if Safari is configured to block cookies
Description: An implementation issue exists in the handling of
cookies set by RSS and Atom feeds. Visiting or updating a feed may
result in a cookie being set, even if Safari is configured to block
cookies via the “Accept Cookies” preference. This update addresses
the issue by respecting the preference while updating or viewing
feeds.

Safari
CVE-ID: CVE-2010-0045
Available for: Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to arbitrary
code execution
Description: An issue in Safari’s handling of external URL schemes
may cause a local file to be opened in response to a URL encountered
on a web page. Visiting a maliciously crafted website may lead to
arbitrary code execution. This update addresses the issue through
improved validation of external URLs. This issue does not affect Mac
OS X systems. Credit to Billy Rios and Microsoft Vulnerability
Research (MSVR) for reporting this issue.

WebKit
CVE-ID: CVE-2010-0046
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A memory corruption issue exists in WebKit’s handling
of CSS format() arguments. Visiting a maliciously crafted website may
lead to an unexpected application termination or arbitrary code
execution. This issue is addressed through improved handling of CSS
format() arguments. Credit to Robert Swiecki of Google Inc. for
reporting this issue.

WebKit
CVE-ID: CVE-2010-0047
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A use-after-free issue exists in the handling of HTML
object element fallback content. Visiting a maliciously crafted
website may lead to an unexpected application termination or
arbitrary code execution. This issue is addressed through improved
memory reference tracking. Credit to wushi of team509, working with
TippingPoint’s Zero Day Initiative for reporting this issue.

WebKit
CVE-ID: CVE-2010-0048
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A use-after-free issue exists in WebKit’s parsing of
XML documents. Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution. This
issue is addressed through improved memory reference tracking.

Webkit
CVE-ID: CVE-2010-0049
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A use-after-free issue exists in the handling of HTML
elements containing right-to-left displayed text. Visiting a
maliciously crafted website may lead to an unexpected application
termination or arbitrary code execution. This issue is addressed
through improved memory reference tracking. Credit to wushi&Z of
team509 for reporting this issue.

WebKit
CVE-ID: CVE-2010-0050
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A use-after-free issue exists in WebKit’s handling of
incorrectly nested HTML tags. Visiting a maliciously crafted website
may lead to an unexpected application termination or arbitrary code
execution. This issue is addressed through improved memory reference
tracking. Credit to wushi&Z of team509 working with TippingPoint’s
Zero Day Initiative for reporting this issue.

WebKit
CVE-ID: CVE-2010-0051
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to the
disclosure of sensitive information
Description: An implementation issue exists in WebKit’s handling of
cross-origin stylesheet requests. Visiting a maliciously crafted
website may disclose the content of protected resources on another
website. This update addresses the issue by performing additional
validation on stylesheets that are loaded during a cross-origin
request.

WebKit
CVE-ID: CVE-2010-0052
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A use-after-free issue exists in WebKit’s handling of
callbacks for HTML elements. Visiting a maliciously crafted website
may lead to an unexpected application termination or arbitrary code
execution. This issue is addressed through improved memory reference
tracking. Credit: Apple.

WebKit
CVE-ID: CVE-2010-0053
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A use-after-free issue exists in the rendering of
content with a CSS display property set to ‘run-in’. Visiting a
maliciously crafted website may lead to an unexpected application
termination or arbitrary code execution. This issue is addressed
through improved memory reference tracking. Credit to wushi of
team509, working with TippingPoint’s Zero Day Initiative for
reporting this issue.

WebKit
CVE-ID: CVE-2010-0054
Available for: Mac OS X v10.4.11, Mac OS X Server v10.4.11,
Mac OS X v10.5.8, Mac OS X Server v10.5.8,
Mac OS X v10.6.1 or later, Mac OS X Server v10.6.1 or later,
Windows 7, Vista, XP
Impact: Visiting a maliciously crafted website may lead to an
unexpected application termination or arbitrary code execution
Description: A use-after-free issue exists in WebKit’s handling of
HTML image elements. Visiting a maliciously crafted website may lead
to an unexpected application termination or arbitrary code execution.
This issue is addressed through improved memory reference tracking.
Credit: Apple.

Safari 4.0.5 is available via the Apple Software Update application,
or Apple’s Safari download site at:
http://www.apple.com/safari/download/

Safari for Mac OS X v10.6.1 to v10.6.3
The download file is named: Safari4.0.5SnowLeopard.dmg
Its SHA-1 digest is: b1b0c3510acf7144a6358b6e5667fb43aaa8a6b9

Safari for Mac OS X v10.5.7
The download file is named: Safari4.0.5Leopard.dmg
Its SHA-1 digest is: 1eccb97a78bac15277702642ed1330ad359205f7

Safari for Mac OS X v10.4.11
The download file is named: Safari4.0.5Tiger.dmg
Its SHA-1 digest is: 9f042b71a08d9c4be7f2dffa3de46622722893e4

Safari for Windows 7, Vista or XP
The download file is named: SafariSetup.exe
Its SHA-1 digest is: 8715db0cee7db82a91bb408e500d255c5d0cfe7c

Safari for Windows 7, Vista or XP from the Microsoft Choice Screen
The download file is named: Safari_Setup.exe
Its SHA-1 digest is: a25377f0febdb702dff1aac5475b113670fd0444

Safari+QuickTime for Windows 7, Vista or XP
The file is named: SafariQuickTimeSetup.exe
Its SHA-1 digest is: 0109adc77d5814f39bb47348df1d3280f30fd397

Information will also be posted to the Apple Security Updates
web site: http://support.apple.com/kb/HT1222

Apple Security Update 2007-002

Jimmy — Thu, 15 Feb 2007 22:21:22 +0000

??ber die Softwareaktualisierung ist soeben ein neues Sicherheitsupdate erschienen, welches jedem Anwender natürlich empfohlen wird. Folgende Komponenten sollen verbessert worden sein:

- CoreServices
- iChat
- UserNotificationCenter

Auch kam gleich ein Java und ein Sommerzeit-Update…

Cisco Pix 501 Firewall

Jimmy — Wed, 07 Feb 2007 23:14:25 +0000

Nun ist endlich die Pix 501 von Cisco bei mir angekommen. Ich habe sie für ca 200 Euro über eBay bezogen und muss sagen, dass ich schon ganz gut begeistert bin. Zum einen habe ich sie mir gekauft, um mich mal wieder im Cisco Bereich weiterzubilden und zum anderen macht es sehr viel Spass die Dinger zu konfigurieren. Dies geht, wie bei Cisco üblich über das CLI oder einem Webinterface, welches jedoch nicht so sehr zu empfehlen ist.

Die Funktionen beinhalten auch das Filtern von z.B. ActiveX Steuerelementen und Java Geschichten. Im Moment beschäftige ich mich mit dem Cisco VPN Client, damit ich mich von überall sicher mit meinem Heimnetzwerk verbinden kann. Beim Kauf war jedoch nur eine DES Verschlüsselung aktiviert, aber man kann sich ein kostenloses Lizenzupgrade über Cisco besorgen, damit man auch Verschlüsselungen wie 3DES oder AES nutzen kann.

Wenn ich mal wieder etwas mehr Zeit habe, werde ich auch ein Konfigurationstutorial online stellen.

Apple Security Update 2007-001

Jimmy — Tue, 23 Jan 2007 21:27:07 +0000

Apple hat soeben über die Softwareaktualisierung ein neues Sicherheutsupdate herausgegeben. Es behebt eine Buffer Overflow Sicherheitslücke in Quicktime 7.1.3 und ist 5,9Mbyte gross.

Nach dem Update ist ein Neustart nötig, den ich jetzt leider nicht machen kann, da ich noch ein Video encode. Ich bin aber trotzdem sicher, da ich heute nicht mehr den Quicktime Player nutzen werde, um auf einer bösen Website ein Video anzuschauen, dass mir dann fiesen Code einschleust.

Gute Nacht!

Apple gibt Sicherheitsupdate 2006-008 frei

Jimmy — Tue, 19 Dec 2006 21:19:46 +0000

Heute ist das Sicherheitsupdate 2006-008 erschienen. Es kann über die Softwareaktualisierung bezogen werden und verbessert die Komponenten Quartz Composer und QuickTime for Java. Weitere Infos gibt es hier.

Apple gibt weiteres Security Update frei

Jimmy — Wed, 29 Nov 2006 06:20:19 +0000

Heute Nacht ist über die Softwareaktualisierung ein neues Security Update (2006-007) für OS X erschienen. Apple erweitert damit die Sicherheit in folgenden Komponenten: AirPort, ATS, CFNetwork, Finder, Font Book?Font Importer, Installer, OpenSSL, PHP, PPP, Samba, Security Framework, VPN, WebKit, gnuzip,perl
Detailierte Informationen gibt es bei Apple. Heise Security erwähnte erst kürzlich Sicherheitslücken im Kernel.

GnuPG Sicherheitsloch gestopft

Jimmy — Wed, 02 Aug 2006 14:24:53 +0000

Wie bereits bei der Version 1.4.4 vorgekommen, werden nun zwei weitere Lücken in der Verschlüsselungssoftware GnuPG geschlossen. Die neue Version 1.4.5 sollte sich jeder Anwender der Software installieren. Ich werde am Wochende ein Tutorial zu GnuPG online stellen, damit ihr eure Emails signieren und verschlüsseln könnt.

Apple Security Update

Jimmy — Wed, 02 Aug 2006 08:33:07 +0000

Gestern ist das Apple Security Update 2006-004 erschienen. Es behebt Sicherheitslücken aus folgenden Bereichen:

AFP Server
Bluetooth
Bom
DHCP
dyld
fetchmail
gnuzip
ImageIO
LaunchServices
OpenSSH
telnet
WebKit

Detailierte Informationen gibt es hier. Das Update wird jedem Benutzer von 10.3.9 und 10.4.7 empfohlen und es ist über die Software-Aktualisierung zu beziehen.

Update

Auf den Heise Security Seiten gibt es weitere Infos zum Security Update. Klick

…Jimmy hört gerade ???Bedshaped??? von Keane (schon 14 mal gehört)