Researchers hide malware in benign apps with the help of speculative execution

OpenSSL Releases Security Update

Original release date: February 26, 2019

OpenSSL version 1.0.2r has been released to address a vulnerability for users of versions 1.0.2–1.0.2q. An attacker could exploit this vulnerability to obtain sensitive information.

The Cybersecurity and Infrastructure Security Agency (CISA) encourages users and administrators to review the OpenSSL Security Advisory and apply the necessary update.

---

This product is provided subject to this Notification and this Privacy & Use policy.

from US-CERT National Cyber Alert System https://ift.tt/2SttOUM

Benefits, Risks And Recommendations For Information Security - ENISA

The key conclusion of this paper is that the cloud’s economies of scale and flexibility are both a friend and a foe from a security point of view. The massive concentrations of resources and data present a more attractive target to attackers, but cloud-based defenses can be more robust, scalable and cost- effective. This paper allows an informed assessment of the security risks and benefits of using cloud computing - providing security guidance for potential and existing users of cloud computing.

Release Date: 11/01/2009

from Cloud Security Alliance Blog https://ift.tt/2Vgewoq

Future Proofing the Connected World - Korean Translation

from Cloud Security Alliance Blog https://ift.tt/2NsgyiD

Cloud Penetration Testing Guidance

This document aims to be a guide for conducting penetration testing on cloud services. The document outlines important aspects such as the scoping of cloud penetration tests, test objectives and legal considerations. The document is a complementary guidance document that should be used in conjunction with existing infrastructure and web application testing frameworks.

from Cloud Security Alliance Blog https://ift.tt/2VoCkqi

USN-3897-1: Thunderbird vulnerabilities

thunderbird vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 18.10
• Ubuntu 18.04 LTS
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS

Summary

Several security issues were fixed in Thunderbird.

Software Description

• thunderbird - Mozilla Open Source mail and newsgroup client

Details

A use-after-free was discovered in libical. If a user were tricked in to opening a specially crafted ICS calendar file, an attacker could potentially exploit this to cause a denial of service. (CVE-2016-5824)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted message, an attacker could potentially exploit these to cause a denial of service, or execute arbitrary code. (CVE-2018-18356, CVE-2018-18500, CVE-2019-5785)

Multiple security issues were discovered in Thunderbird. If a user were tricked in to opening a specially crafted website in a browsing context, an attacker could potentially exploit these to cause a denial of service, gain additional privileges by escaping the sandbox, or execute arbitrary code. (CVE-2018-18501, CVE-2018-18505)

An issue was discovered with S/MIME signature verification in some circumstances. An attacker could potentially exploit this by spoofing signatures for arbitrary content. (CVE-2018-18509)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10

thunderbird - 1:60.5.1+build2-0ubuntu0.18.10.1

Ubuntu 18.04 LTS

thunderbird - 1:60.5.1+build2-0ubuntu0.18.04.1

Ubuntu 16.04 LTS

thunderbird - 1:60.5.1+build2-0ubuntu0.16.04.1

Ubuntu 14.04 LTS

thunderbird - 1:60.5.1+build2-0ubuntu0.14.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Thunderbird to make all the necessary changes.

References

• CVE-2016-5824
• CVE-2018-18356
• CVE-2018-18500
• CVE-2018-18501
• CVE-2018-18505
• CVE-2018-18509
• CVE-2019-5785

from Ubuntu Security Notices https://ift.tt/2EcHCOG

USN-3896-1: Firefox vulnerabilities

firefox vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

• Ubuntu 18.10
• Ubuntu 18.04 LTS
• Ubuntu 16.04 LTS
• Ubuntu 14.04 LTS

Summary

Firefox could be made to crash or run programs as your login if it opened a malicious website.

Software Description

• firefox - Mozilla Open Source web browser

Details

Multiple security issues were discovered in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service, bypass same origin protections, or execute arbitrary code.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 18.10

firefox - 65.0.1+build2-0ubuntu0.18.10.1

Ubuntu 18.04 LTS

firefox - 65.0.1+build2-0ubuntu0.18.04.1

Ubuntu 16.04 LTS

firefox - 65.0.1+build2-0ubuntu0.16.04.1

Ubuntu 14.04 LTS

firefox - 65.0.1+build2-0ubuntu0.14.04.1

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

After a standard system update you need to restart Firefox to make all the necessary changes.

References

• CVE-2018-18356
• CVE-2018-18511
• CVE-2019-5785

from Ubuntu Security Notices https://ift.tt/2H32vig