Last day to save $500 for SANS San Diego 2013

@RISK: The Consensus Security Vulnerability Alert

Volume: VIII, Issue: 32
August 6, 2009

SANS Newsletters Home

It isn't Microsoft this time - Apple Macs have a LOT of critical vulnerabilities being patched this week. And Sun's JAVA JRE and JDK have multiple critical vulnerabilities, as well.|||||| Alan

@RISK is the SANS community's consensus bulletin summarizing the most important vulnerabilities and exploits identified during the past week and providing guidance on appropriate actions to protect your systems (PART I). It also includes a comprehensive list of all new vulnerabilities discovered in the past week (PART II).

Summary of the vulnerabilities reported this week:

    • Category
    • # of Updates & Vulnerabilities
    • Platform Number of Updates and Vulnerabilities
    • -------------------------- -------------------------------------
    • Other Microsoft Products
    • 1
    • Linux
    • 3
    • Solaris
    • 1
    • Aix
    • 1
    • Cross Platform
    • 33 (#1, #2, #3, #5, #6, #7)
    • Web Application - Cross Site Scripting
    • 8
    • Web Application - SQL Injection
    • 14
    • Web Application
    • 14
    • Network Device
    • 1 (#4)
    • Hardware
    • 1

*********** Sponsored By RSA, The Security Division of EMC ***********

"How RSA envision® Delivers an Industry's Best ROI" http://www.sans.org/info/46968 This White Paper examines the Return on Investment (ROI) that a quality Security Information & Event Management (SIEM) solution can deliver to an organization.

************************************************************************* TRAINING UPDATE - - SANS Network Security, San Diego Sept. 14-22; the Fall's biggest security training conference-- 20 full length courses and 16 short courses plus a big exhibition http://www.sans.org/ns2009 - - SANS Virginia Beach August 28 - Sept. 4. 11 full-length courses plus short courses: http://www.sans.org/vabeach09/ - - The Virtualization and Cloud Security Summit on August 17-18 in Washington; courses in the following days http://www.sans.org/info/43118 Looking for training in your own community? http://sans.org/community/ Save on On-Demand training (30 full courses) - See samples at http://www.sans.org/ondemand/spring09.php Plus Atlanta, Canberra, Cairo, Stockholm, Dubai, Dublin & Rome all in the next 90 days. For a list of all upcoming events, on-line and live: www.sans.org

*************************************************************************

Table Of Contents
Part II -- Comprehensive List of Newly Discovered Vulnerabilities from Qualys (www.qualys.com)
Other Microsoft Products
Linux
Solaris
Aix
Cross Platform
Web Application - Cross Site Scripting
Web Application - SQL Injection
Web Application
Network Device
Hardware

************************* Sponsored Links: **********************

1) ***NEW*** SANS Free Vendor Audio Casts! Visit the SANS Reading Room and click on the Free Vendor Audio Casts link. http://www.sans.org/info/46973

2) Be sure to register for the upcoming Analyst Webcast: Top Ten Virtualization Security Mistakes and How to Avoid Them Sponsored by: McAfee, Inc. & Catbird http://www.sans.org/info/46978

3) In case you missed it! Check out the Ask The Expert Webcast: Managing Change and Event Monitoring for Sustainable NERC CIP Compliance http://www.sans.org/info/46983

*************************************************************************

PART I Critical Vulnerabilities

Part I for this issue has been compiled by Rohan Kotian at TippingPoint, a division of 3Com, as a by-product of that company's continuous effort to ensure that its intrusion prevention products effectively block exploits using known vulnerabilities. TippingPoint's analysis is complemented by input from a council of security managers from twelve large organizations who confidentially share with SANS the specific actions they have taken to protect their systems. A detailed description of the process may be found at http://www.sans.org/newsletters/cva/#process

Widely Deployed Software
  • (1) CRITICAL: Apple Mac OS X Multiple Vulnerabilities
  • Affected:
    • Mac OS X v10.4.11 and prior
    • Mac OS X v10.5 through v10.5.7
    • Mac OS X Server v10.4.11 and prior
    • Mac OS X Server v10.5 through 10.5.7

  • Description: Apple Mac OS X contains multiple vulnerabilities in a variety of its subsystems. Specially crafted input or data handled by one of these components could trigger vulnerability, leading to a variety of exploitable conditions. There is an out of bounds error in bzip2. An error in CFNetwork layer may allow an attacker control the displayed website URL in a certificate warning. There is a heap overflow error while processing images with an embedded ColorSync profile. There is a stack overflow error while processing Canon RAW images. A heap overflow error, multiple integer overflow errors and an uninitialized memory access error have been identified within ImageIO while handling OpenEXR images. There is a stack overflow error in ImageIO in its handling of EXIF metadata. There is an uninitialized pointer issue while processing certain PNG images. There are some implementation issues in the kernel which might give local users elevated privileges. A denial-of service condition exists in inetd-based launchd service. There is a format string issue because of the way Login Window handles certain application names. There is a buffer overflow issue in the kernel in the way it handles AppleTalk response packets. A buffer overflow exists in the XQuery in its handling of character classes in regular expressions. There are some other vulnerabilities which might be less critical. Many of these vulnerabilities mentioned earlier might be leveraged to execute arbitrary code with the privileges of the current user or vulnerable process.

  • Status: Vendor confirmed, updates available.

  • References:
  • (4) HIGH: Apple iPhone SMS Application Memory Corruption Vulnerability
  • Affected:
    • Apple iPhone 2.2.1
    • Apple iPhone 2.0.x
    • Apple iPhone 1.1.x
    • Apple iPhone 1.0.x
    • Apple iPhone 3.0
    • Apple iPhone 2.x
    • Apple iPhone 1.1
    • Apple iPhone 1

  • Description: Apple iPhone, a very popular multimedia GSM smartphone by Apple Inc, contains a vulnerability. A specially crafted Short Message Service (SMS) message could trigger a memory corruption vulnerability in the affected system. The specific flaw is caused due to an error in the decoding of SMS messages. Successful exploitation might lead to service interruption or even arbitrary code execution. Some technical details of the vulnerability are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
  • (5) HIGH: SAP Business One License Manager Buffer Overflow Vulnerability
  • Affected:
    • SAP Business One 2005-A versions 6.80.x

  • Description: SAP Business One is integrated enterprise resource planning (ERP) solution from SAP AG aimed at targeting software requirements of small and medium size enterprises. A buffer overflow vulnerability has been identified in SAP Business One and a specially crafted request to TCP port 30000 can trigger it. The specific flaw is a boundary error in the license manager service "NT_Naming_Service.exe" while processing the requests going to TCP port 30000. Successful exploitation might allow an attacker to crash the system or execute arbitrary code with elevated privileges. Full technical details along with Proof-of-Concept of this vulnerability are publicly available.

  • Status: Vendor confirmed, updates available.

  • References:
  • (6) HIGH: SILC Format String Vulnerability
  • Affected:
    • SILC Client version 1.1.7 and prior

  • Description: Secure Internet Live Conferencing (SILC) is a protocol designed to provide secure conferencing services over the internet. Multiple format string vulnerabilities have been identified in SILC Client and a specially crafted nickname can be used to trigger one of these vulnerabilities. The specific flaws are format string errors in "lib/silcclient/client_entries.c" while processing nicknames. Successful exploitation might allow an attacker to crash the affected client or execute arbitrary code.

  • Status: Vendor confirmed, updates available.

  • References:
  • (7) MODERATE: Mozilla Firefox Multiple Vulnerabilities
  • Affected:
    • Mozilla Firefox 3.0.x
    • Mozilla Firefox 3.5.x

  • Description: Mozilla Firefox web-browser based on the Mozilla suite of applications contains multiple vulnerabilities. The first issue is a Location bar and SSL indicator spoofing which could allow an attacker to display misleading information about the location and SSL information of the invalid web-page. The second issue is unspecified memory corruption errors in the browser engines that Firefox and other Mozilla-based products use. The third issue is a privilege escalation error caused due window's global object receiving an incorrect security wrapper and it affects pages that have 'Link:' Header are installed with an add-on which implemented a Content Policy in JavaScript, such as AdBlock Plus or NoScript. Details for these vulnerabilities are available via source code analysis.

  • Status: Vendor confirmed, updates available.

  • References:
Part II: Weekly Comprehensive List of Newly Discovered Vulnerabilities
Week 32, 2009

This list is compiled by Qualys ( www.qualys.com ) as part of that company's ongoing effort to ensure its vulnerability management web service tests for all known vulnerabilities that can be scanned. As of this week Qualys scans for 7326 unique vulnerabilities. For this special SANS community listing, Qualys also includes vulnerabilities that cannot be scanned remotely.

  • 09.32.1 - CVE: Not Available
  • Platform: Other Microsoft Products
  • Title: Microsoft Internet Explorer 8 Denial of Service
  • Description: Microsoft Internet Explorer is a browser available for multiple platforms. The browser is exposed to a remote denial of service issue. To exploit this issue, the attacker must entice an unsuspecting user to visit a malicious site. The issue affects Internet Explorer 8; other versions may also be vulnerable.
  • Ref: http://www.securityfocus.com/bid/35941
  • 09.32.2 - CVE: CVE-2009-2410
  • Platform: Linux
  • Title: Fedora SSSD BE Database No Password Authentication Bypass
  • Description: Fedora SSSD provides a set of daemons to manage access to remote directories and other authentication mechanisms. The application is exposed to an authentication bypass issue. This issue occurs because the application allows users to be added to the SSSD BE database without setting the password. This will allow attackers to login to the application with any password.
  • Ref: https://bugzilla.redhat.com/show_bug.cgi?id=514057
  • 09.32.3 - CVE: Not Available
  • Platform: Linux
  • Title: Linux Kernel "kernel/signal.c" Local Information Disclosure
  • Description: The Linux kernel is exposed to a local information disclosure issue that occurs in the "sigaltstack()" function of the "kernel/signal.c" file. Successful exploitation will disclose a certain amount of kernel stack memory. Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks. Ref: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=0083fc2c50e6c5127c2802ad323adf8143ab7856
  • 09.32.4 - CVE: Not Available
  • Platform: Linux
  • Title: Linux Kernel "clear_child_tid()" Local Denial of Service
  • Description: The Linux kernel is exposed to a local denial of service issue that arises because the value of "clear_child_tid" is not cleared before a parent process writes to the memory of a child process. Attackers can exploit this issue to corrupt memory, resulting in a denial of service condition.
  • Ref: http://lkml.org/lkml/2009/7/31/76
  • 09.32.5 - CVE: Not Available
  • Platform: Solaris
  • Title: Sun Solaris Trusted Extensions Labeled Packets Remote Denial of Service
  • Description: Sun Solaris is prone to a remote denial of service issue. The issue occurs in Solaris Trusted Extensions and arises when labeled packets are parsed. A remote privileged user may exploit this issue to panic the vulnerable system, effectively denying service to legitimate users. Solaris 10 and OpenSolaris snv_37 through snv_120 are affected.
  • Ref: http://sunsolve.sun.com/search/document.do?assetkey=1-66-264808-1
  • 09.32.6 - CVE: Not Available
  • Platform: Aix
  • Title: IBM AIX "_LIB_INIT_DBG" and "_LIB_INIT_DBG_FILE" File Creation
  • Description: IBM AIX is a UNIX-based operating system. IBM AIX is exposed to a file creation issue due to an error affecting the "_LIB_INIT_DBG" and "_LIB_INIT_DBG_FILE" environment variables. A local attacker can exploit this issue when executing setuid root programs that are linked with the XL C++ library. AIX versions 5.3 and 6.1 are affected.
  • Ref: http://www.securityfocus.com/bid/35934
  • 09.32.7 - CVE: CVE-2009-2049
  • Platform: Cross Platform
  • Title: Cisco IOS Malformed Border Gateway Protocol Update Denial of Service
  • Description: Cisco IOS is exposed to a remote denial of service issue that occurs when handling specially crafted Border Gateway Protocol (BGP) updates. An attacker can exploit these issues to cause an affected device to reload, denying service to legitimate users.
  • Ref: http://www.securityfocus.com/archive/1/505365
  • 09.32.8 - CVE: CVE-2009-1168
  • Platform: Cross Platform
  • Title: Cisco IOS Malformed BGP Anonymous System Path Denial of Service
  • Description: Cisco IOS is exposed to a remote denial of service issue that occurs when handling specially crafted Border Gateway Protocol (BGP) updates. An attacker can exploit these issues to cause an affected device to reload, denying service to legitimate users.
  • Ref: http://www.securityfocus.com/archive/1/505365
  • 09.32.9 - CVE: CVE-2009-2286
  • Platform: Cross Platform
  • Title: compface ".xbm" File Remote Buffer Overflow
  • Description: compface is an application used to construct images for "X-Face" Usenet signatures. compface is exposed to a remote stack-based buffer overflow issue because it fails to perform adequate checks on user-supplied input. Specifically, this issue occurs when the application parses ".xbm" files containing excessive data. compface version 1.5.2 is affected.
  • Ref: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=534973
  • 09.32.10 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Intel System Management Mode Local Privilege Escalation
  • Description: Intel BIOS is exposed to an unspecified privilege escalation issue. System Management Mode is a privileged mode of execution in which all normal operations, including the operating system, are suspended. System Management Mode is generally used to handle low-level hardware operations. Ref: http://security-center.intel.com/advisory.aspx?intelid=INTEL-SA-00018&languageid=en-fr
  • 09.32.11 - CVE: Not Available
  • Platform: Cross Platform
  • Title: PHP Interruptions and Calltime Arbitrary Code Execution
  • Description: PHP is a general-purpose scripting language that is especially suited for web development and can be embedded into HTML. PHP is exposed to an arbitrary code execution issue. This issue occurs because certain PHP functions can be interrupted by user-space functions in error cases or as callbacks.
  • Ref: http://www.securityfocus.com/bid/35867
  • 09.32.12 - CVE: Not Available
  • Platform: Cross Platform
  • Title: EPSON Status Monitor Insecure File Permissions Local Privilege Escalation
  • Description: EPSON Status Monitor is a utility that monitors products and gives the current status of the product. The application is exposed to a local privilege escalation issue that stems from a design error. This issue occurs because the application assigns insecure file permissions to certain applications during installation. Specifically, the "E_S40ST7.EXE" binary is installed with full permissions for every user.
  • Ref: http://www.securityfocus.com/archive/1/505410
  • 09.32.13 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Open Handset Alliance Android SMS Remote Denial of Service
  • Description: Open Handset Alliance Android (previously Google Android) is a software stack and operating system for mobile phones. The software is exposed to a denial of service issue when handling malicious SMS messages. Specifically, receiving a malicious SMS message will cause affected devices to temporarily disconnect from the network.
  • Ref: http://www.securityfocus.com/bid/35886
  • 09.32.14 - CVE: CVE-2009-2404
  • Platform: Cross Platform
  • Title: Mozilla SeaMonkey Regular Expression Parsing Heap Buffer Overflow
  • Description: Mozilla SeaMonkey is an open source Web browser, email and newsgroup client, IRC chat client, and HTML editor. SeaMonkey is exposed to a heap-based buffer overflow issue that occurs in the regular expression parser used to match common names in SSL certificates. Attackers can exploit this issue with a specially crafted certificate. SeaMonkey version 1.09 is affected.
  • Ref: http://awe.com/mark/blog/20090730.html
  • 09.32.15 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Adobe Flash Player and AIR Unspecified Privilege Escalation
  • Description: Adobe Flash Player is a multimedia application for Microsoft Windows, Mozilla, and Apple technologies. Adobe AIR is a cross-platform runtime for developing internet applications on the desktop. Flash Player and AIR are exposed to an unspecified privilege escalation issue. Flash Player versions prior to 10.0.32.18 and AIR versions prior to 1.5.2 are affected.
  • Ref: http://www.adobe.com/support/security/bulletins/apsb09-10.html
  • 1.5.2 - CVE: CVE-2009-186610.0.32.18 and AIR versions prior to are affected.
  • Platform: Cross Platform
  • Title: Adobe Flash Player and AIR (CVE-2009-1866) Stack Buffer Overflow
  • Description: Adobe Flash Player is a multimedia application for Microsoft Windows, Mozilla, and Apple technologies. Adobe AIR is a cross-platform runtime for developing internet applications on the desktop. Flash Player and AIR are exposed to an unspecified stack-based buffer overflow issue. Flash Player versions prior to
  • Ref: http://www.adobe.com/support/security/bulletins/apsb09-10.html
  • 09.32.18 - CVE: CVE-2009-1864
  • Platform: Cross Platform
  • Title: Adobe Flash Player and AIR Unspecified Heap Buffer Overflow
  • Description: Adobe Flash Player is a multimedia application for Microsoft Windows, Mozilla, and Apple technologies. Adobe AIR is a cross-platform runtime for developing internet applications on the desktop. Flash Player and AIR are exposed to an unspecified heap-based buffer overflow issue. Flash Player versions prior to 10.0.32.18 and AIR versions prior to 1.5.2 are affected.
  • Ref: http://www.adobe.com/support/security/bulletins/apsb09-10.html
  • 09.32.19 - CVE: CVE-2009-1867
  • Platform: Cross Platform
  • Title: Adobe Flash Player and AIR Unspecified Click Jacking
  • Description: Adobe Flash Player is a multimedia application for Microsoft Windows, Mozilla, and Apple technologies. Adobe AIR is a cross-platform runtime for developing internet applications on the desktop. Flash Player and AIR are exposed to an unspecified click jacking issue. Flash Player versions prior to 10.0.32.18 and Adobe AIR versions prior to 1.5.2 are affected.
  • Ref: http://www.adobe.com/support/security/bulletins/apsb09-10.html
  • 09.32.20 - CVE: CVE-2009-1865
  • Platform: Cross Platform
  • Title: Adobe Flash Player and AIR NULL Pointer Exception Remote Code Execution
  • Description: Adobe Flash Player is a multimedia application for Microsoft Windows, Mozilla, and Apple technologies. Adobe AIR is a cross-platform runtime for developing internet applications on the desktop. Flash Player and AIR are exposed to an unspecified remote code execution issue due to a NULL-pointer exception. Flash Player versions prior to 10.0.32.18 and Adobe AIR versions prior to 1.5.2 are affected.
  • Ref: http://www.adobe.com/support/security/bulletins/apsb09-10.html
  • 09.32.21 - CVE: CVE-2009-1869
  • Platform: Cross Platform
  • Title: Adobe Flash Player and AIR Unspecified Integer Overflow
  • Description: Adobe Flash Player is a multimedia application for Microsoft Windows, Mozilla, and Apple technologies. Adobe AIR is a cross-platform runtime for developing internet applications on the desktop. Flash Player and AIR are exposed to an unspecified integer overflow issue. Flash Player versions prior to 10.0.32.18 and Adobe AIR versions prior to 1.5.2 are affected.
  • Ref: http://www.securityfocus.com/archive/1/505467
  • 09.32.22 - CVE: CVE-2009-1870
  • Platform: Cross Platform
  • Title: Adobe Flash Player and AIR Sandbox Bypass Information Disclosure
  • Description: Adobe Flash Player is a multimedia application for Microsoft Windows, Mozilla, and Apple technologies. Adobe AIR is a cross-platform runtime for developing internet applications on the desktop. Flash Player and AIR are exposed to an information disclosure issue. Specifically, the applications fail to securely implement restricted sandboxes for saved SWF files. Flash Player versions prior to 10.0.32.18 and AIR versions prior to 1.5.2 are affected.
  • Ref: http://www.adobe.com/support/security/bulletins/apsb09-10.html
  • 09.32.23 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Google SketchUp ".skp" File Remote Buffer Overflow
  • Description: Google SketchUp is an application for creating, modifying and sharing 3D models. The application is exposed to a remote stack-based buffer overflow issue because it fails to perform adequate checks on user-supplied input. Specifically, this issue occurs when the application parses specially crafted ".skp" files. Google SketchUp version 7.0.10247 is affected.
  • Ref: http://www.securityfocus.com/bid/35911
  • 09.32.24 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Sun VirtualBox Host Operating System Local Denial of Service
  • Description: Sun VirtualBox is an open-source virtualization software. The application is exposed to a local denial of service issue. Specifically, a local attacker can call privileged level 0 system procedure "sysenter" from the guest OS and restart the host OS. Sun VirtualBox versions 2.2 through 3.0.2 are affected.
  • Ref: http://www.securityfocus.com/bid/35915
  • 09.32.25 - CVE: Not Available
  • Platform: Cross Platform
  • Title: BlazeVideo BlazeDVD Professional ".PLF" File Remote Buffer Overflow
  • Description: BlazeDVD Professional is a DVD player and recorder for Microsoft Windows. BlazeDVD Professional is exposed to a buffer overflow issue because the application fails to perform adequate boundary checks on user-supplied data. The issue occurs when handling a malformed ".PLF" file. BlazeDVD Professional version 5.1 is affected.
  • Ref: http://www.securityfocus.com/bid/35918
  • 09.32.26 - CVE: Not Available
  • Platform: Cross Platform
  • Title: PHP Fuzzer Framework Default Location Insecure Temporary File Creation
  • Description: PHP Fuzzer Framework is a file fuzzing application. The application creates temporary files in an insecure manner. This issue occurs because the application uses a default location to save files and this location can be accessed by other users.
  • Ref: http://www.securityfocus.com/bid/35924
  • 09.32.27 - CVE: CVE-2009-2470
  • Platform: Cross Platform
  • Title: Mozilla Firefox SOCKS5 Proxy Response Denial of Service
  • Description: Mozilla Firefox is a browser available for multiple platforms. The browser is exposed to a remote denial of service issue that occurs because SOCKS5 proxy replies containing a DNS name longer than 15 characters may corrupt subsequent data streams in proxy responses. Firefox versions prior to 3.5.2 and 3.0.12 are affected.
  • Ref: http://www.mozilla.org/security/announce/2009/mfsa2009-38.html
  • 09.32.28 - CVE: CVE-2009-2198
  • Platform: Cross Platform
  • Title: Apple GarageBand Information Disclosure
  • Description: Apple GarageBand allows users to create music. The application is exposed to an information disclosure issue that arises because GarageBand changes Apple Safari browser's preferences and causes the browser to accept cookies from third party sites. It is conjectured that due to the changes caused by GarageBand, cookies from third party sites hosting content on a domain visited by a user are accepted when cookies should only be accepted from the domain being visited. GarageBand versions prior to 5.1 for Mac OS X 10.5.7 are affected.
  • Ref: http://www.securityfocus.com/bid/35926
  • 09.32.29 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Mozilla Firefox 3.5.1/3.0.12 Multiple Memory Corruption Vulnerabilities
  • Description: Mozilla Firefox is a web browser. It is available for multiple platforms. Firefox is exposed to multiple remote memory corruption vulnerabilities. Some of these issues arise in the "vorbis_book_decodevv_add" at "vorbis_codebook.c" and the "jstracer.cpp" source files of the 3.5.x versions of Firefox. Another issue arises in the "jsdbgapi.c" source file of the 3.0.x versions of the browser. Mozilla Firefox versions prior to 3.5.2 and 3.0.13 are affected.
  • Ref: http://www.mozilla.org/security/announce/2009/mfsa2009-45.html
  • 09.32.30 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Mozilla Firefox Incorrect Security Wrapper JavaScript Chrome Privilege Escalation
  • Description: Mozilla Firefox is a web browser. Firefox is exposed to a privilege escalation issue. Specifically the issue occurs due an incorrect security wrapper passed to the "window" global object. The issue may arise when the browser with an add-on implementing a Content Policy (such as AdBlock Plus or NoScript) opens pages that have a "Link:" HTTP header. The issue affects Firefox versions 3.5 prior to 3.5.2.
  • Ref: http://www.mozilla.org/security/announce/2009/mfsa2009-46.html
  • 09.32.31 - CVE: Not Available
  • Platform: Cross Platform
  • Title: SAP Business One 2005 License Manager "NT_Naming_Service.exe" Buffer Overflow
  • Description: SAP Business One 2005 is an application suite. The application is exposed to a buffer overflow issue because it fails to bounds check user-supplied data before copying it into an insufficiently sized buffer. This issue exists in the "NT_Naming_Service.exe" process.
  • Ref: http://www.securityfocus.com/archive/1/505489
  • 09.32.32 - CVE: Not Available
  • Platform: Cross Platform
  • Title: IBM Tivoli Key Lifecycle Manager Password Unspecified Vulnerability
  • Description: IBM Tivoli Key Lifecycle Manager is an application that manages encryption keys and certificates. The application is exposed to an unspecified issue related to passwords. The issue affects IBM Tivoli Key Lifecycle Manager version 1.0 on AIX, Linux, Solaris, and Windows platforms.
  • Ref: http://www-01.ibm.com/support/docview.wss?rs=0&uid=swg21395577
  • 09.32.33 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Sun Java Runtime Environment Audio System Privilege Escalation
  • Description: Sun Java Runtime Environment (JRE) is an enterprise development platform. JRE is exposed to a privilege escalation issue when running untrusted applications or applets. This issue is related to the audio system. The attacker can exploit this issue by enticing an unsuspecting victim into viewing a web page containing a malicious Java applet.
  • Ref: http://sunsolve.sun.com/search/document.do?assetkey=1-66-263408-1
  • 09.32.34 - CVE: Not Available
  • Platform: Cross Platform
  • Title: SILC Client Format String
  • Description: SILC (Secure Internet Live Conferencing) is a protocol that provides secure conferencing services in the internet. SILC Client implements a client supporting the SILC protocol. SILC client is exposed to a format string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function. SILC client versions prior to 1.1.8 are affected.
  • Ref: http://silcnet.org/docs/release/SILC%20Client%201.1.8
  • 09.32.35 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Sun Java Runtime Environment JPEG Image Handling Integer Overflow
  • Description: Sun Java Runtime Environment (JRE) is an enterprise development platform. Sun Java Runtime Environment (JRE) is exposed to an integer overflow issue that arises when the application handles a specially-crafted JPEG image file through an untrusted Java Web Start application. The attacker can exploit this issue by enticing an unsuspecting victim into viewing a web page containing a malicious Java Web Start application.
  • Ref: http://sunsolve.sun.com/search/document.do?assetkey=1-66-263428-1
  • 09.32.36 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Sun Java Runtime Environment Proxy Mechanism Implementation Privilege Escalation Vulnerabilities
  • Description: Sun Java Runtime Environment (JRE) is an enterprise development platform. JRE is exposed to multiple privilege escalation issues in the proxy mechanism implementation. The attacker can exploit these issues by enticing an unsuspecting victim into viewing a web page containing a malicious Java applet. Successful exploits may allow attackers to perform actions with elevated privileges and gain access to sensitive information, hijack sessions and violate the same-origin policy.
  • Ref: http://sunsolve.sun.com/search/document.do?assetkey=1-66-263409-1
  • 09.32.37 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Sun Java Runtime Environment Unpack200 JAR Unpacking Utility Integer Overflow
  • Description: Sun Java Runtime Environment (JRE) is an enterprise development platform. Sun Java Runtime Environment (JRE) is exposed to an integer overflow issue that arises when the Unpack200 JAR unpacking utility handles specially-crafted packed applets and Java Web Start applications. JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier are affected.
  • Ref: http://java.sun.com/j2se/1.5.0/ReleaseNotes.html#150_20
  • 09.32.38 - CVE: Not Available
  • Platform: Cross Platform
  • Title: Sun JRE/JDK Java Web Start ActiveX Control ATL Remote Code Execution
  • Description: Java Web Start ActiveX Control is used by the Java Web Start technology included in the Java Runtime Environment (JRE and JDK). Java Web Start ActiveX Control is exposed to a remote code execution issue. A remote attacker can exploit this issue by enticing an unsuspecting victim into viewing a malicious web page. If successful, the attacker can run arbitrary code with the privileges of the user running the affected application. JDK and JRE 6 Update 14 and earlier and JDK and JRE 5.0 Update 19 and earlier are affected.
  • Ref: http://sunsolve.sun.com/search/document.do?assetkey=1-66-264648-1
  • 09.32.39 - CVE: Not Available
  • Platform: Cross Platform
  • Title: JNLPAppletLauncher Arbitrary File Creation
  • Description: JNLPAppletLauncher is a JNLP-based class for deploying and launching applets that use extension libraries containing native code. JNLPAppletLauncher is exposed to an issue that allows attackers to write arbitrary files on the vulnerable system.
  • Ref: http://sunsolve.sun.com/search/document.do?assetkey=1-66-263490-1
  • 09.32.40 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: Miniweb Site Builder Module Multiple Cross-Site Scripting Vulnerabilities
  • Description: Miniweb is a web application implemented in PHP. Site Builder is a module for Miniweb. The module is exposed to multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied data to the "sitebuilder_id" and "PHP_SELF" parameters of the "index.php" script. Site Builder module for Miniweb version 2.0 is affected.
  • Ref: http://www.securityfocus.com/bid/35871
  • 09.32.41 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: TYPO3 Mailform Extension Unspecified Cross-Site Scripting
  • Description: Mailform is an extension for the TYPO3 content manager. The extension is exposed to an unspecified cross-site scripting issue because it fails to properly sanitize user-supplied input. Mailform versions 0.9.23 and earlier are affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.42 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: TYPO3 Twitter Search Extension Unspecified Cross-Site Scripting
  • Description: TYPO3 Twitter Search (twittersearch) is an extension for the TYPO3 content manager. The extension is exposed to an unspecified cross-site scripting issue because it fails to properly sanitize user-supplied input. Twitter Search versions 0.1.0 and earlier are affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.43 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: TYPO3 Webesse E-Card Extension Unspecified Cross-Site Scripting
  • Description: TYPO3 Webesse E-Card (ws_ecard) is an extension for the TYPO3 content manager. The extension is exposed to an unspecified cross-site scripting issue because it fails to properly sanitize user-supplied input. Webesse E-Card versions 1.0.2 and earlier are affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.44 - CVE: CVE-2009-2492
  • Platform: Web Application - Cross Site Scripting
  • Title: Movable Type "mt-wizard.cgi" Cross-Site Scripting
  • Description: Movable Type is a web-log application written in PERL and PHP. The application is exposed to a cross-site scripting issue because it fails to sufficiently sanitize user-supplied input to the "mt-wizard.cgi" script. Movable Type versions prior to 4.261 are affected.
  • Ref: http://www.securityfocus.com/bid/35885
  • 09.32.45 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: NTSOFT BBS E-Market Professional Multiple Cross-Site Scripting Vulnerabilities
  • Description: NTSOFT BBS E-Market Professional is a Korean e-commerce application. The application is exposed to multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied data to the "page", "bt_code" and "bt_no" parameters of the "index.php" script.
  • Ref: http://www.securityfocus.com/bid/35893
  • 09.32.46 - CVE: Not Available
  • Platform: Web Application - Cross Site Scripting
  • Title: XOOPS "op" Parameter Multiple Cross-Site Scripting Vulnerabilities
  • Description: XOOPS is a PHP-based content manager. The application is exposed to multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied data to the "op" parameter of the "viewpmsg.php" script and the "PHP_SELF" parameter of the "user.php" script. XOOPS version 2.3.3 is affected.
  • Ref: http://www.securityfocus.com/archive/1/505451
  • 09.32.47 - CVE: CVE-2009-2595
  • Platform: Web Application - Cross Site Scripting
  • Title: Censura Prior to 2.1.1 Multiple Cross-Site Scripting Vulnerabilities
  • Description: Censura is a web-based application. The application is exposed to multiple cross-site scripting issues because it fails to sufficiently sanitize user-supplied data before including it in generated content. Specifically, an issue affects the "q" parameter of the "productSearch.html" script when the "action" parameter is set to "ProductSearch". Censura versions prior to 2.1.1 are affected.
  • Ref: http://www.censura.info/forums/project.php?issueid=151
  • 09.32.48 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: MySQL Connector/J Unicode Character String SQL Injection
  • Description: MySQL Connector/J is a JDBC Type 4 driver that allows Java applications to connect to MySQL. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data before being used in an SQL query. This issue occurs when specific Unicode characters are handled and a certain character set such as "SJIS/Windows-31J" is used. MySQL Connector/J version 5.1.7 is affected.
  • Ref: http://jvn.jp/en/jp/JVN59748723/index.html
  • 09.32.49 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: TYPO3 CoolURI Extension Unspecified SQL Injection
  • Description: CoolURI ("colluri") is an extension for the TYPO3 content manager. The extension is exposed to an SQL injection issue because it fails to sufficiently sanitize input before using it in an SQL query. CoolURI versions prior to 1.0.16 a are affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.50 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: TYPO3 Reset backend password Extension Unspecified SQL Injection
  • Description: Reset backend password ("cwt_resetbepassword") is an extension for the TYPO3 content manager. The extension is exposed to an SQL injection issue because it fails to sufficiently sanitize input before using it in an SQL-query. Reset backend password affects versions 1.2.0 and earlier are affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.51 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: TYPO3 Webesse Image Gallery Extension Unspecified SQL Injection
  • Description: Webesse Image Gallery ("ws_gallery") is an extension for the TYPO3 content manager. The extension is exposed to an SQL injection issue because it fails to sufficiently sanitize input before using it in an SQL-query. Webesse Image Gallery versions 1.0.4 and earlier are affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.52 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: TYPO3 datamints Newsticker Extension Unspecified SQL Injection
  • Description: datamints Newsticker ("datamints_newsticker") is an extension for the TYPO3 content manager. The extension is exposed to an SQL injection issue because it fails to sufficiently sanitize input before using it in an SQL query. datamints Newsticker versions prior to 0.7.2 are affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.53 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: TYPO3 Tour Extension Unspecified SQL Injection
  • Description: Tour Extension ("pm_tour") is an extension for the TYPO3 content manager. The extension is exposed to an SQL injection issue because it fails to sufficiently sanitize input before using it in an SQL-query. Tour Extension versions prior to 2.0.13 are affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.54 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: TYPO3 Myth download Extension Unspecified SQL Injection
  • Description: Myth download ("myth_download") is an extension for the TYPO3 content manager. The extension is exposed to an SQL injection issue because it fails to sufficiently sanitize input before using it in an SQL-query. Myth download version 0.1.0 is affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.55 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: Article Publisher Pro "photos.php" SQL Injection
  • Description: Article Publisher Pro is a PHP-based content manager. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "album" parameter of the "photos.php" script before using it in an SQL query. Article Publisher Pro version 2.0.3 is affected.
  • Ref: http://www.securityfocus.com/bid/35892
  • 09.32.56 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: Softbiz Dating Script "cat_products.php" SQL Injection
  • Description: Softbiz Dating Script is a web-based dating script. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "cid" parameter of the "cat_products.php" script before using it in an SQL query.
  • Ref: http://www.softbizscripts.com/dating-script-features.php
  • 09.32.57 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: Mobilelib Gold Multiple SQL Injection Vulnerabilities
  • Description: Mobilelib Gold is a web-based application. The application is exposed to multiple SQL injection issues because it fails to sufficiently sanitize user-supplied data. Mobilelib Gold version 3.0 is affected.
  • Ref: http://www.securityfocus.com/bid/35910
  • 09.32.58 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: Joomla! JFusion ("com_jfusion") Component "Itemid" Parameter SQL Injection
  • Description: The JFusion "com_jfusion" component is a component for the Joomla! content manager. It facilitates universal user integration. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "Itemid" parameter of the "com_jfusion" component before using it in an SQL query.
  • Ref: http://www.securityfocus.com/bid/35912
  • 09.32.59 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: Arab Portal "forum.php" SQL Injection
  • Description: Arab Portal is a web-based application. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "qc" parameter of the "forum.php" script before using it an SQL query.
  • Ref: http://www.securityfocus.com/bid/35914
  • 09.32.60 - CVE: Not Available
  • Platform: Web Application - SQL Injection
  • Title: Discloser "more" Parameter SQL Injection
  • Description: phpHoo3 is a web log application implemented in PHP. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data to the "more" parameter of the "index.php" script before using it in an SQL query.
  • Ref: http://www.securityfocus.com/archive/1/505478
  • 09.32.61 - CVE: CVE-2009-2579
  • Platform: Web Application - SQL Injection
  • Title: CS-Cart "reward_points.post.php" SQL Injection
  • Description: CS-Cart is a web-based application. The application is exposed to an SQL injection issue because it fails to sufficiently sanitize user-supplied data before using it in an SQL query. This issue affects the "sort_order" parameter of the "index.php" script when called with the "dispatch" parameter set to "reward_points.userlog", and is caused by an error in the "reward_points.post.php" source code file. CS-Cart versions prior to 2.0.6 are affected.
  • Ref: http://www.securityfocus.com/archive/1/505492
  • 09.32.62 - CVE: Not Available
  • Platform: Web Application
  • Title: Django URL Information Disclosure
  • Description: Django is a web-based news application. The application is exposed to an information disclosure issue that occurs because the application allows unauthorized users to access files on a victim's computer. Specifically, the application fails to properly check if the requested file is a static media file used by Django. Django development trunk versions 0.96 and 1.0 are affected.
  • Ref: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=539134
  • 09.32.63 - CVE: Not Available
  • Platform: Web Application
  • Title: Drupal Bibliography Module "title" HTML Injection
  • Description: Bibliography is a PHP-based component for the Drupal content manager. The application is exposed to an HTML injection issue because it fails to properly sanitize user-supplied input to the "title" text before displaying it in a user's browser. Bibliography Module versions prior to 6.x-1.6 and 5.x-1.17 are affected.
  • Ref: http://drupal.org/node/534842
  • 09.32.64 - CVE: Not Available
  • Platform: Web Application
  • Title: Intesync LLC Miniweb Publisher Module SQL Injection and Cross-Site Scripting Vulnerabilities
  • Description: Intesync LLC Publisher is a PHP-based content publishing module for the Miniweb 2.0 content manager. The application is exposed to multiple input validation issues. Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Publisher for Miniweb version 2.0 is affected.
  • Ref: http://www.securityfocus.com/bid/35869/references
  • 09.32.65 - CVE: Not Available
  • Platform: Web Application
  • Title: Miniweb Survey Pro Module SQL Injection and Cross-Site Scripting Vulnerabilities
  • Description: Miniweb is a web-based application. Survey Pro is a module for Miniweb. The module is exposed to an SQL injection issue because it fails to properly sanitize user-supplied input to the "campaign_id" parameter of the "index.php" script before using it in an SQL query. The application is also exposed to a cross-site scripting issue that affects the "PHP_SELF" variable of the "index.php" script. The Survey Pro module for Miniweb 2.0 is affected.
  • Ref: http://www.securityfocus.com/bid/35870
  • 09.32.66 - CVE: Not Available
  • Platform: Web Application
  • Title: TYPO3 Front End News Submitter Extension SQL Injection and Cross-Site Scripting Vulnerabilities
  • Description: The Front End News Submitter is an extension for the TYPO3 content manager. The extension is not part of the TYPO3 default installation. The extension is exposed to an SQL injection issue and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data to certain unspecified parameters. Front End News Submitter versions 0.1.0 and earlier are affected. Ref: http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-010/
  • 09.32.67 - CVE: Not Available
  • Platform: Web Application
  • Title: Drupal Live Module Node Edit Privilege Escalation
  • Description: The Live module for Drupal provides preview functionality for nodes. The module is exposed to a privilege escalation issue that may result in a user editing a node gaining access as the user who created the node. Live versions 6.x prior to version 6.x-1.2 are affected.
  • Ref: http://drupal.org/node/534914
  • 09.32.68 - CVE: Not Available
  • Platform: Web Application
  • Title: Avant Browser "browser:home" Multiple HTML Injection Vulnerabilities
  • Description: Avant Browser is a web browser application available for multiple operating systems. The application is exposed to multiple HTML injection issues because it fails to properly sanitize user-supplied input before using it in dynamically generated content. These issues affects the "History", "Most Visited", and "Bookmarks" sections of the "browser:home" page. Avant Browser version 11.7 build 35 is affected. Ref: http://lostmon.blogspot.com/2009/07/avant-browser-browserhome-persistent.html
  • 09.32.69 - CVE: Not Available
  • Platform: Web Application
  • Title: Joomla!
  • Description: Joomla! is a PHP-based content management system. The "com_mailto" component of Joomla! is exposed to a remote security bypass issue. Specifically, it is possible to bypass timeout protection used to prevent the automated sending of mail. Joomla! versions prior to 1.5.14 are affected. Ref: http://developer.joomla.org/security/news/303-20090723-core-com-mailto-timeout-issue.html
  • 09.32.70 - CVE: Not Available
  • Platform: Web Application
  • Title: eAccelerator "encoder.php" Remote Code Execution
  • Description: eAccelerator is a PHP-based open source PHP accelerator, optimizer, and dynamic content cache. The application is exposed to an issue that lets attackers execute arbitrary files. The issue occurs because the application allows attacker to copy a local file to web root directory using "-o" option and request the file as if it was an uploaded image.
  • Ref: http://www.securityfocus.com/bid/35917
  • 09.32.71 - CVE: Not Available
  • Platform: Web Application
  • Title: ProjectButler "pda_projects.php" Remote File Include
  • Description: ProjectButler is a project management application. The application is exposed to a remote file include issue because it fails to sufficiently sanitize user-supplied input to the "offset" parameter of the "pda_projects.php" script. ProjectButler version 1.5.0 is affected.
  • Ref: http://www.securityfocus.com/bid/35919
  • 09.32.72 - CVE: Not Available
  • Platform: Web Application
  • Title: Arab Portal "module" Parameter Local File Include
  • Description: Arab Portal is a web portal implemented in PHP. The application is exposed to a local file include issue because it fails to properly sanitize user-supplied input to the "module" parameter of the "mod.php" script. Arab Portal version 2.2 is affected.
  • Ref: http://www.securityfocus.com/bid/35921
  • 09.32.73 - CVE: Not Available
  • Platform: Web Application
  • Title: Palm WebOS Email Notification System "FROM" Field Arbitrary Script Code Injection
  • Description: Palm WebOS is a smartphone platform based on Linux. Palm WebOS is exposed to a Palm WebOS issue that exists in the Email Notification System because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. The vulnerability affects the "FROM" field when receiving a malicious email. Palm WebOS version 1.0.4 is affected.
  • Ref: http://www.securityfocus.com/archive/1/505490
  • 09.32.74 - CVE: Not Available
  • Platform: Web Application
  • Title: WordPress Prior to Version 2.8.3 "wp-admin" Multiple Security Bypass Vulnerabilities
  • Description: WordPress is a web-based publishing application. The application is exposed to multiple security bypass issues that affect "wp-admin" administrative scripts. Authenticated attackers may exploit this issue to gain access to administrative functions, which may allow them to obtain sensitive information or elevate privileges; other attacks may also be possible. WordPress versions prior to 2.8.3 are affected.
  • Ref: http://core.trac.wordpress.org/changeset/11769
  • 09.32.75 - CVE: Not Available
  • Platform: Web Application
  • Title: Shopmaker Local File Include and SQL Injection Vulnerabilities
  • Description: Shopmaker is a PHP-based content manager. The application is exposed to multiple input validation issues. An attacker can exploit the local file include vulnerability using directory-traversal strings to view and execute arbitrary local files within the context of the webserver process. Information harvested may aid in further attacks. Shopmaker version 2.0 is affected.
  • Ref: http://www.securityfocus.com/bid/35937
  • 09.32.76 - CVE: Not Available
  • Platform: Network Device
  • Title: HTC Touch 3G Windows Mobile SMS Remote Denial of Service
  • Description: HTC Touch 3G Windows Mobile is a smartphone device. The device is exposed to a denial of service issue when handling malicious SMS messages. Specifically, receiving a malicious SMS message will cause the device's user interface to stop responding. Ref: http://www.cbsnews.com/stories/2009/07/30/tech/cnettechnews/main5197522.shtml
  • 09.32.77 - CVE: Not Available
  • Platform: Hardware
  • Title: Absolute Software Computrace LoJack for Laptops Security Bypass
  • Description: Absolute Software Computrace LoJack for Laptops is a laptop theft-recovery service. The application resides in a laptop's BIOS. The application is exposed to a security bypass issue because its communication to a central authority is not properly secured. Attackers can harvest and alter configuration details. This permits attackers to masquerade as a central authority, permit malicious code installation, or launch further attacks.
  • Ref: http://blogs.zdnet.com/security/?p=3828

I learned more at this conference than 2 other training conferences I have attended combined.
-Steve Farmer, LANL

Get an iPad or Nexus 10 with Online Training

Latest Whitepapers

Building and Maintaining a "Certifiable" Workforce
By Robert J. Mavretich

How Can You Build and Leverage SNORT IDS Metrics to Reduce Risk?
By Tim Proffitt

Daisy Chain Authentication
By Courtney Imbert

Latest Tweets

NEW #SANS Survey: Security Analytics & Intelligence 2nd [...]
October 1, 2013 - 6:30 PM

Tips on how to convince your boss to let you train online wi [...]
October 1, 2013 - 6:23 PM

#2 Tip on how 2 convince your boss 2 let u train online: Fle [...]
October 1, 2013 - 3:00 PM

Contact Us

(301) 654-SANS (7267)
Mon-Fri 9am - 8pm EST/EDT
info@sans.org

"It was a great learning experience that helped open my eyes wider. The instructor's knowledge was fantastic."
- Manuja Wikesekera, Melbourne Cricket Club

"The perfect balance of theory and hands-on experience."
- James D. Perry II, University of Tennessee

"SANS is far more in-depth than other training I have attended."
- Frank Rajnai, Sears Canada Inc