Thursday, June 18, 2009

Clusterfuzzing

›
I've just noticed that a Google search for "clusterfuzzing" (including the quotes) has no hits. Therefore, I'm reserving t...
1 comment:
Wednesday, June 10, 2009

Bonus Safari XXE (only affecting Safari 4 Beta)

›
Here's another XXE bug for you (resulting in file theft), just to make the point that this class of bugs is well worth watching out for ...
Tuesday, June 9, 2009

Apple's Safari 4 also fixes cross-domain XML theft

›
Safari 4 also fixes an interesting cross-domain XML theft. Full technical details live here: http://scary.beasts.org/security/CESA-2009-008....
Monday, June 8, 2009

Apple's Safari 4 fixes local file theft attack

›
Safari 4 was just released and among the various improvements is a range of security fixes . One of these fixes is for an XXE attack against...
2 comments:
Friday, May 29, 2009

vsftpd-2.1.2 released and new security tricks

›
(Note: v2.1.2 is the same as v2.1.1 but with a compile fix) vsftpd-2.1.2 is released with full details as always on the vsftpd home page: ht...
7 comments:
Wednesday, May 20, 2009

A more plausible E4X attack

›
As a quick recap, "E4X" is the name of a Javascript standard relating to strong XML support in the language. Firefox has had an im...
Friday, May 1, 2009

HiTB Dubai: all over apart from the blogging

›
I recently had the pleasure to be invited by Dhillon to present at HackInTheBox (HiTB) Dubai with Billy Rios on our "Cross Domain Leaki...
2 comments: