Security World: May 2011

Tuesday, May 31, 2011

Mini IP Camera with Wireless Network Video Server

Dear All,

Good day!

Attached please you find the file of IP Camera with Network Video Server.

If you are interested in them or have any questions, and can feel free to contact me.

Looking forwards…

Regards,

Carl

[SECURITY] [DSA 2250-1] citadel security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2250-1 security@debian.org
http://www.debian.org/security/ Nico Golde
March 31, 2011 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : citadel
Vulnerability : denial of service
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-1756

Wouter Coekaerts discovered that the jabber server component of citadel,
a complete and feature-rich groupware server, is vulnerable to the so-called
"billion laughs" attack because it does not prevent entity expansion on
received data. This allows an attacker to perform denial of service
attacks against the service by sending specially crafted XML data to it.

For the oldstable distribution (lenny), this problem has been fixed in
version 7.37-8+lenny1.

For the stable distribution (squeeze), this problem has been fixed in
version 7.83-2squeeze2.

For the testing (wheezy) and unstable(sid) distributions,
this problem will be fixed soon.

We recommend that you upgrade your citadel packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk3lWZ0ACgkQHYflSXNkfP931ACeNRFzg5jx3Ca7zotWpQs42S8h
h4UAn2pNrf9/sr6duOU05yG3bauDiBjI
=ah12
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/20110531211157.GA13526@ngolde.de

[SECURITY] [DSA 2249-1] jabberd14 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2249-1 security@debian.org
http://www.debian.org/security/ Nico Golde
March 31, 2011 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : jabberd14
Vulnerability : denial of service
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-1754

Wouter Coekaerts discovered that jabberd14, an instant messaging server
using the Jabber/XMPP protocol, is vulnerable to the so-called
"billion laughs" attack because it does not prevent entity expansion on
received data. This allows an attacker to perform denial of service
attacks against the service by sending specially crafted XML data to it.

The oldstable distribution (lenny), does not contain jabberd14.

For the stable distribution (squeeze), this problem has been fixed in
version 1.6.1.1-5+squeeze1.

For the testing distribution (wheezy), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 1.6.1.1-5.1

We recommend that you upgrade your jabberd14 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk3lWGYACgkQHYflSXNkfP+4IACeJxeVkXTIlPONJB4qs0FYTI4b
BXQAoI1epUV+r6p3P+NOEoA+fRVxQ3yq
=64+6
-----END PGP SIGNATURE-----

[SECURITY] [DSA 2248-1] ejabberd security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2248-1 security@debian.org
http://www.debian.org/security/ Nico Golde
March 31, 2011 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : ejabberd
Vulnerability : denial of service
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-1753

Wouter Coekaerts discovered that ejabberd, a distributed XMPP/Jabber server
written in Erlang, is vulnerable to the so-called "billion laughs" attack
because it does not prevent entity expansion on received data.
This allows an attacker to perform denial of service attacks against the
service by sending specially crafted XML data to it.

For the oldstable distribution (lenny), this problem has been fixed in
version 2.0.1-6+lenny3.

For the stable distribution (squeeze), this problem has been fixed in
version 2.1.5-3+squeeze1.

For the testing distribution (wheezy), this problem will be fixed soon.

For the unstable distribution (sid), this problem has been fixed in
version 2.1.6-2.1.

We recommend that you upgrade your ejabberd packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk3lVy8ACgkQHYflSXNkfP9+XwCZASQIxH5wedS/Sv5RVbLq72TX
BCQAmwa5smfQdADSxcAw9vRXuTPmuck4
=s7fb
-----END PGP SIGNATURE-----

Cell phone use 'possibly' a cause of brain cancer, says WHO panel

More malware apps sneak into Google Market | Steve Ballmer: Office 365 to launch in June

Network World Daily News PM

Forward this to a Friend >>>

Cell phone use 'possibly' a cause of brain cancer, says WHO panel
Reversing an earlier conclusion that no such link could be established, the World Health Organization today has issued a new report that says cell phone use is "possibly carcinogenic to humans, based on an increased risk for glioma, a malignant type of brain cancer." While stressing that more research will be required to confirm the link, these experts nonetheless are recommending that cell-phone users... Read More

RESOURCE COMPLIMENTS OF: Cisco Systems, Inc.

World IPv6 Day with Cisco
By the end of 2011, there will be no more IPv4 addresses. Cisco IPv6 solutions can help your organization extend its reach and harness the power of the growing Internet. Based on your industry, we can help you maximize the value of your existing investments while you prepare for the next wave of Internet growth. Learn More>

In this Issue

WEBCAST: F5 Networks

Ensuring High Availability for Client Access
F5's integrated application delivery solutions for Microsoft Exchange Server 2010 provide the required hardware load balancing for CAS servers. Learn More!

More malware apps sneak into Google Market
More malware targeting Google Android devices but pretending to be legit apps managed to sneak into Google Market over the long holiday weekend, and Google did take steps to yank them, according to a mobile security firm. Read More

Steve Ballmer: Office 365 to launch in June
Steve Ballmer said Microsoft's cloud productivity service will launch next month. Read More

Jobs to keynote Apple WWDC, introduce iCloud
Apple's Worldwide Developers Conference will introduce the iCloud service, as well as updates to OS X and iOS Read More

WHITE PAPER: F5 Networks

Providing Security and Acceleration for Remote Users
Delivering applications to remote users is a significant undertaking. Applications need to be available, and they must be delivered securely and quickly. Through a range of products, F5 has solved the security plus acceleration challenge for remote users with BIG-IP Edge Gateway and BIG-IP APM. Read More!

Daily innovation smackdown: Biz Stone vs. Lou Gerstner
Lou Gerstner was chairman of the board at IBM from 1993 until his retirement in 2002 , during which he made network-centric computing a cornerstone of IBM strategy. He saw to it that even though IBM faded in the PC market, it remained relevant with Big Blue's mainframes. Biz Stone had plenty of naysayers when Twitter was rolled out. What can you say in 140 characters, many asked. Perhaps riding the coattails of Facebook, Twitter became an integral part of social networking to the point of now saying it has 105 million users. Read More

Spending on new software projects rises, survey says
For the first time, companies around the world are planning to spend as much on new software projects as they do maintaining existing systems, according to a new report from Forrester Research. Read More

Ricoh announces enterprise device with tablet features
Ricoh on Tuesday announced a tablet-like device that can function as an e-reader and digital clipboard for enterprises to electronically write, capture and record documents. Read More

WHITE PAPER: Siemens

3 Steps for Choosing the Right UC Solution
Communication is at the heart of how many small businesses operate. However, few organizations stop to consider how the way they communicate is inefficient. Many consider this to be a cost of doing business. But what if your business could overcome these problems? Learn More

Why Microsoft and Citrix need each other
Desktop virtualization company Citrix made news last week with an overhaul of its major product lines and the introduction of "Project Olympus," a cloud infrastructure stack based on open source software. But pretty high up in CEO Mark Templeton's keynote at Citrix Synergy Conference 2011 in San Francisco was a big shout out to Microsoft. Read More

IBM improves Sametime platform
IBM recently released enhancements to its IBM Sametime platform with improvements that deliver native and third-party audio and video conferencing in browser-based meetings, and extend unified communications to new mobile devices. Read More

Oracle says ERP software woes are school's own fault
Oracle has fired back against a New Jersey university's claim it is responsible for a problematic ERP (enterprise resource planning) software project, saying school officials have embarked on a "scorched earth" litigation campaign in order to cover up their own shortcomings. Read More

SURVEY: Future-proofing the cloud
Where do you think cloud computing is headed? This survey enables you to share your views on some potential future events, trends and technology changes driven by cloud computing. By compiling the shared knowledge, opinions and insights of survey participants, everyone will get a clearer view on which changes and trends are more, or less, likely to actually occur. That knowledge will be invaluable in helping you shape your private, public and hybrid cloud strategy and plans for the future.Take the survey.

GOODIES FROM THE SUBNETS
Up for grabs from the Subnets: Cisco Subnet: 15 copies of IPv6 for Enterprise Networks books. Microsoft Subnet: A set of classes for a Microsoft Cert from Webucator and Polycom videoconferencing system.. Enter here.

SLIDESHOWS

7 things we love about Drupal 7
Drupal. the open source Content Management System (CMS) used to power everything from personal sites to the White House's Web site, is legendary for its flexibility and power. Here are the best things about it.

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_daily_news_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

[SECURITY] [DSA 2247-1] rails security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2247-1 security@debian.org
http://www.debian.org/security/ Thijs Kinkhorst
May 31, 2011 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : rails
Vulnerability : several vulnerabilities
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-0446 CVE-2011-0447
Debian Bug : 614864

Several vulnerabilities have been discovered in Rails, the Ruby web
application framework. The Common Vulnerabilities and Exposures project
identifies the following problems:

CVE-2011-0446

Multiple cross-site scripting (XSS) vulnerabilities when JavaScript
encoding is used, allow remote attackers to inject arbitrary web
script or HTML.

CVE-2011-0447

Rails does not properly validate HTTP requests that contain an
X-Requested-With header, which makes it easier for remote attackers
to conduct cross-site request forgery (CSRF) attacks.

For the oldstable distribution (lenny), this problem has been fixed in
version 2.1.0-7+lenny0.1.

For the stable distribution (squeeze), this problem has been fixed in
version 2.3.5-1.2+squeeze0.1.

For the unstable distribution (sid), this problem has been fixed in
version 2.3.11-0.1.

We recommend that you upgrade your rails packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iQEcBAEBAgAGBQJN5TtyAAoJEOxfUAG2iX57LXsH/3eyIiCabIgvXydXhFhz0sCG
DvIJt4Mg9ficfkI73Mxsq3ERhUiXXi4cpqLaAKQxa3Nd4rYuMu5Ir7zR5i5SOOUe
8pRx2wARb28uEzmvbcWvyIXxkxYXKwaUJgtK4Vaq6JBTx5LpBJyZojJ/JFLX07Ca
15H44DLSdd1pJOwj4iLpkGP2I3uS1eL0KU2yatRNApz7zelCGmzJVoOtbdBNe0jt
WdIwW1NqynEi5g3GSatMqj0mGWZ9Wp8VgIayPjqpJv3mCyesSxJ4IQXzaq8Rs+4W
Iuzv4h3SrM4OfGA8uYYxPtps6vpDIqc2l8oVQK8/f3qS1uTAMAN2d/Wh90P7UZw=
=YPdC
-----END PGP SIGNATURE-----

Cutting Costs with a Virtual Workforce

Learn the four flavors of client virtualization technologies. Read more now!

Forrester Research: The Key to Expanding Business and Cutting Costs

This Forrester paper describes how businesses could lower costs across labor, facilities and travel by implementing a virtual workforce and validates the points with survey data from both the US and China.

Read Now

ITworld 3 Square Image. Forward this to a Friend >>

Learn how to make cloud an integral part of your enterprise storage and data protection strategy.

SUBSCRIPTION SERVICES
You are currently subscribed as security.world@gmail.com. If you do not wish to receive future mailings from ITworld Online Resources, need to change your email or other preference, please visit: http://optouts.itworld.com/index.html?dept_id=43&emid=pyKllpH2BklbiwYMiAs0tyXjVZiIkK3IkTINkLYjHcM%3d. If the above URL is not enabled as a link, please copy it in to your browser window to access our Subscription Page.

View ITworld's online privacy policy.

Copyright 2011 | ITworld | 492 Old Connecticut Path | Framingham MA 01701 | www.ITworld.com

Years vs. know-how when hiring IT pros; Skype issues software fix for Windows and Mac users

Skype issues software fix for Windows and Mac users | IE Flaw Could Allow Hackers Access to your Facebook, Gmail, Twitter Accounts

Network World Microsoft

Forward this to a Friend >>>

The hubris of years: IT prowess can't be measured only by time on the job
Sean McCown: I've been doing quite a bit of interviewing lately (again) and am struck by how everyone seems to prize how long they've been doing something over how well they do it. Read More

WHITE PAPER: Quest Software

Transaction Tracing through Complex Web Applications
In this Quest white paper, learn about the components of a transaction as they cross various application domains. Then, discover the difficulty in connecting transaction components for monitoring, why continuously monitoring is key and how a third-party solution simplifies the challenge. Learn more.

In this Issue

WHITE PAPER: HP & Intel

3PAR Storage: Tailor-Made for Virtual Infrastructures
As users have adopted virtual server technology for their less critical applications, many are now seriously considering the idea of moving their Tier 1 production applications. Done properly, virtualizing these types of applications will bring compelling benefits, including increased IT agility and lower costs of ownership. Read now

Skype issues software fix for Windows and Mac users
Jon Brodkin: Skype has released a new version of its Windows software to fix the problem that prevented some users from logging in and making calls, and plans to issue a similar update to Mac users later today, the company said. Read More

IE Flaw Could Allow Hackers Access to your Facebook, Gmail, Twitter Accounts
Ms. Smith: You might not want to do any drag-and-dropping within your IE browser, or you might be done in by "cookiejacking." Read More

WHITE PAPER: F5 Networks

ROI of Application Delivery Controllers
How modern offload technologies in Application Delivery Controllers can drastically reduce expenses in traditional and virtualized architectures, with a fast ROI. Learn More!

Ballmer ignores call for his head, talks Windows 8, China piracy
Jon Brodkin: I'm sure every week in the life of Microsoft CEO Steve Ballmer must be hectic, but this one seemed especially interesting, at least from the outside looking in. Read More

Samsung latest Galaxy Tab: Sleeker than the Xoom, still no iPad
Jon Brodkin: The Samsung Galaxy Tab 10.1 is set to be released June 8, and while this may be the best Android tablet so far, it still doesn't match the intuitive experience offered by the iPad 2. Read More

WHITE PAPER: Diskeeper Corporation

NEW Diskeeper 2011 Pro Premier Edition
Diskeeper 2011 Pro Premier edition provides essential performance and efficiency increases for power workstation users as well as all the features of the Professional edition. Learn more!

PBS hacked by LulzSec: Lulz Boat Sailed, PBS Failed
Ms. Smith: Sunday night, after the Public Broadcasting System aired a documentary on WikiLeaks, displeased hacktivists from LulzSec sailed its "Lulz Boat" to PBS servers. The group posted a bogus news story to the PBS's Newshour website. Read More

Hotmail Exploit Silently Snooped & Microsoft Audio CAPTCHA Easily Defeated
Ms. Smith: More bad news for Microsoft in the form of security researchers proving two very different fails - audio CAPTCHAs defeated and Hotmail exploited to silently "steal" email. Read More

Visit Microsoft Subnet for more daily news, blogs
This newsletter features posts from the Microsoft Subnet community of industry expert bloggers plus news and giveaways. We've got a set of Microsoft certification classes and two Polycom systems to give away. Follow us on Twitter @microsoftsubnet Read More

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_microsoft_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

Hidden URLs in phone and tablet browsers

5 top social media security threats | Can you have too much security?

Network World Security Strategies

Forward this to a Friend >>>

Hidden URLs in phone and tablet browsers
Internet users should be extremely cautious before installing upcoming netbook/tablet PC versions of Google Chrome and Mozilla Firefox which hide the URL of Web sites that users visit – a technique known as compact Web page navigation. Read More

WHITE PAPER: Dell

The Business Case for Security Information Management
It is a mistake to assume that information security is solely a technical problem left for IT to solve. This guide is a non-technical discussion of security information management. Learn more.

In this Issue

WEBCAST: Oracle

Oracle Business Intelligence Foundation
Oracle BI Foundation Suite delivers the broadest end to end BI functionality from reporting, dashboards, scorecards, scenario modeling, forecasting to ad-hoc analysis. Register Today!

5 top social media security threats
Social media platforms such as Twitter, Facebook and LinkedIn increasingly are being used by enterprises to engage with customers, build their brands and communicate information to the rest of the world. Read More

Can you have too much security?
Is there such a thing as too much security? Read More

PBS hacked by LulzSec: Lulz Boat Sailed, PBS Failed
Sunday night, after the Public Broadcasting System aired a documentary on WikiLeaks, displeased hacktivists from LulzSec sailed its "Lulz Boat" to PBS servers. The group posted a bogus news story to the PBS's Newshour website, claiming that reports of rapper Tupac Shakur's death in 1996 had been grossly exaggerated. In fact, the news stated that Tupac had been found "alive and well," living in New... Read More

WEBCAST: Oracle

How Oracle Exalogic and Exadata Deliver Extreme Java
View this webcast to learn why Exalogic and Exadata are the definitive engineered platforms for enterprise application and database consolidation, with added advantage of extreme Java and database performance, unmatched reliability and scalability, and cloud-enabling elastic capacity. Register Today!

Memory encryption breakthrough claimed by NC State researchers
Researchers at North Carolina State University claim they've achieved a breakthrough in how encryption can be used in technology called non-volatile main memory, which is seen as an eventual replacement for conventional dynamic random-access memory. Read More

RSA tokens may be behind major network security problems at Lockheed Martin
Lockheed Martin's has "major internal computer network problems," that one security blogger is linking to compromised RSA tokens, according to published reports. Read More

New malware scanner finds 5% of Windows PCs infected
One in every 20 Windows PCs whose users turned to Microsoft for cleanup help were infected with malware, Microsoft said this week. Read More

Key lessons learned from Sony hack-fest
The relentless cyberattacks against Sony should have businesses planning now what they will do when they, too, run afoul of ideologically motivated adversaries, experts say. Read More

Microsoft downplays IE 'cookiejacking' bug
Microsoft today downplayed the threat posed by an unpatched vulnerability in all versions of Internet Explorer (IE) that an Italian researchers has shown can be exploited to hijack people's online identities. Read More

Cloud CIO: The Two Biggest Lies About Cloud Security
Survey after survey note that security is the biggest concern potential users have with respect to public cloud computing. Here, for example, is a survey from April 2010, indicating that 45 percent of respondents felt the risks of cloud computing outweigh its benefits. CA and the Ponemon Institute conducted a survey and found similar concerns. But they also found that deployment had occurred despite these worries. And similar surveys and results continue to be published, indicating the mistrust about security persists. Read More

Mobile phones are great for phishers, researchers find
Computer users seem to be getting better at spotting fake websites that are trying to steal their passwords, but when it comes to mobile phones, the deck is most definitely stacked against them. Read More

Not even security managers immune to FakeAV infection
Can you believe it? As I sat down this morning to write this column, I got hit by a drive-by download of FakeAV. Read More

GOODIES FROM THE SUBNETS
Up for grabs from Cisco Subnet: 15 copies of IPv6 for Enterprise Networks. Enter here.

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_security_strategies_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **