[B! vulnerability] nobu666ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯

nobu666 id:nobu666

vulnerabilityã«é–¢ã™ã‚‹nobu666ã®ãƒ–ãƒƒã‚¯ãƒžãƒ¼ã‚¯ (17)

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

${{author_name}}$
{{author_name}}{{created}}
{{ #comment }}{{ comment }}{{ /comment }}
- {{ label }}

${{author_name}}$

{{{comment_expanded}}}

{{label}}

{{#is_bookmark}}ãƒªã‚¹ãƒˆ{{/is_bookmark}}{{^is_bookmark}}ãƒªãƒ³ã‚¯{{/is_bookmark}}

Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ãƒ†ã‚¹ãƒˆãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã€Œw3af 1.0ã€ãƒªãƒªãƒ¼ã‚¹ - SourceForge.JP Magazine : ã‚ªãƒ¼ãƒ—ãƒ³ã‚½ãƒ¼ã‚¹ã®è©±é¡Œæº€è¼‰
Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã‚’ç™ºè¦‹ã™ã‚‹ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã€ŒWeb Application Attack and Audit Frameworkï¼ˆw3afï¼‰ 1.0ã€ãŒå…¬é–‹ã•ã‚ŒãŸã€‚SourceForgeã®ãƒ—ãƒã‚¸ã‚§ã‚¯ãƒˆãƒšãƒ¼ã‚¸ã‚ˆã‚Šãƒ€ã‚¦ãƒ³ãƒãƒ¼ãƒ‰ã§ãã‚‹ã€‚ w3afã¯Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ãŸã‚Šã€å®Ÿéš›ã«è„†å¼±æ€§ã«å¯¾ã™ã‚‹æ”»æ’ƒã‚’è¡Œã†ãŸã‚ã®ãƒ•ãƒ¬ãƒ¼ãƒ ãƒ¯ãƒ¼ã‚¯ã€‚é–‹ç™ºè€…ã‚„ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ç ”ç©¶è€…ãŒã€Webã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æ¤œæŸ»ã‚„ãƒ†ã‚¹ãƒˆã«åˆ©ç”¨ã™ã‚‹ã“ã¨ã‚’æƒ³å®šã—ã¦ã„ã‚‹ã€‚ãƒ—ãƒã‚°ãƒ©ãƒ ã¯Pythonã§æ›¸ã‹ã‚Œã¦ãŠã‚Šã€GPLã§å…¬é–‹ã•ã‚Œã¦ã„ã‚‹ã€‚ã‚³ã‚¢ã®ã»ã‹ã€SQLã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ã€ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚°ï¼ˆXXSï¼‰ãªã©ã‚’ãƒã‚§ãƒƒã‚¯ã§ãã‚‹130ç¨®ä»¥ä¸Šã®ãƒ—ãƒ©ã‚°ã‚¤ãƒ³ã‚’æŒã¤ã€‚ åˆã®æ£å¼ç‰ˆã§ã¯ã€ã‚³ãƒ¼ãƒ‰ã®å®‰å®šæ€§ã€è‡ªå‹•ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ãƒˆãªã©ã®ç‰¹å¾´ã‚’æŒã¤ã€‚ã‚¯ãƒ©ãƒƒã‚·ãƒ¥ã‚’æœ€å°é™ã«æŠ‘ãˆã€å¸¸ã«æœ€æ–°æ©Ÿèƒ½ã‚’ä½¿ãˆã‚‹ã¨ã„ã†ã€‚ æ–°æ©Ÿèƒ½ã¨ã—ã¦ã¯ã€PHPã®é™çš„
nobu666 2011/06/02
tools

security

vulnerability
ãƒªãƒ³ã‚¯
BINDã«æ·±åˆ»ãªãœã„å¼±æ€§ã€ãƒªãƒ¢ãƒ¼ãƒˆæ”»æ’ƒã§ã‚µãƒ¼ãƒ“ã‚¹åœæ¢ã®å±é™º
æ—¥æœ¬ãƒ¬ã‚¸ã‚¹ãƒˆãƒªã‚µãƒ¼ãƒ“ã‚¹ï¼ˆJPRSï¼‰ã¯2011å¹´5æœˆ27æ—¥ã€DNSã‚µãƒ¼ãƒãƒ¼ã‚½ãƒ•ãƒˆã€ŒBINDã€ã«æ·±åˆ»ãªãœã„å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã¨è¦å‘Šã—ãŸï¼ˆç™ºè¡¨è³‡æ–™ï¼‰ã€‚æ‚ªæ„ã‚ã‚‹ç¬¬ä¸‰è€…ã‹ã‚‰ãƒãƒƒãƒˆãƒ¯ãƒ¼ã‚¯è¶Šã—ã«ãƒªãƒ¢ãƒ¼ãƒˆã§æ”»æ’ƒã‚’å—ã‘ã‚‹ã¨ã€namedï¼ˆDNSã‚µãƒ¼ãƒãƒ¼ã®å®Ÿä½“ã¨ãªã‚‹ãƒ—ãƒã‚»ã‚¹ï¼‰ãŒåœæ¢ã™ã‚‹å±é™ºæ€§ãŒã‚ã‚‹ã€‚å¯¾è±¡ã¨ãªã‚‹ã®ã¯ã€ç¾åœ¨ã‚µãƒãƒ¼ãƒˆã•ã‚Œã¦ã„ã‚‹ã™ã¹ã¦ã®BIND 9ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€‚ å…·ä½“çš„ã«ã¯ã€BIND 9ã§ã®ãƒã‚¬ãƒ†ã‚£ãƒ–ã‚ãƒ£ãƒƒã‚·ãƒ¥ã®æ‰±ã„ã«å®Ÿè£…ä¸Šã®ãƒã‚°ãŒã‚ã‚‹ã€‚ãƒã‚¬ãƒ†ã‚£ãƒ–ã‚ãƒ£ãƒƒã‚·ãƒ¥ã¨ã¯ã€Œãã®ãƒ‰ãƒ¡ã‚¤ãƒ³åã¯å˜åœ¨ã—ãªã„ã€ã€Œãã®ãƒªã‚½ãƒ¼ã‚¹ãƒ¬ã‚³ãƒ¼ãƒ‰ã¯å˜åœ¨ã—ãªã„ã€ã¨ã„ã£ãŸæƒ…å ±ã®ã‚ãƒ£ãƒƒã‚·ãƒ¥ã®ã“ã¨ã€‚ã‚ã‚‰ã‹ã˜ã‚ã€Œå˜åœ¨ã—ãªã„ã€ã¨ã„ã†æƒ…å ±ã‚’ã‚ãƒ£ãƒƒã‚·ãƒ¥ã—ã¦ãŠãã“ã¨ã§ã€DNSã®å¿œç”é€Ÿåº¦ã‚’å‘ä¸Šã•ã›ã€DNSã‚µãƒ¼ãƒãƒ¼ã«å¯¾ã™ã‚‹è² è·ã‚’è»½æ¸›ã™ã‚‹æ©Ÿèƒ½ã ã€‚ã“ã®ãƒã‚°ã‚’æŠ±ãˆãŸDNSã‚µãƒ¼ãƒãƒ¼ãŒã€æ¨©å¨DNSã‚µãƒ¼ãƒãƒ¼ã‹ã‚‰ã‚µã‚¤ã‚ºã®å¤§ããªRRSIGãƒªã‚½ãƒ¼ã‚¹ãƒ¬ã‚³ãƒ¼ãƒ‰ã‚»ãƒƒãƒˆã‚’å«ã‚€å¦å®šå¿œç”ã‚’
nobu666 2011/05/30
bind

vulnerability

security
ãƒªãƒ³ã‚¯
CERT/CC Vulnerability Note VU#536044
OpenSSL leaks ECDSA private key through a remote timing attack Vulnerability Note VU#536044 Original Release Date: 2011-05-17 | Last Revised: 2011-06-01 The OpenSSL ladder implementation for scalar multiplication of points on elliptic curves over binary fields is susceptible to a timing attack vulnerability. This vulnerability can be used to steal the private key of a TLS server that authenticates
nobu666 2011/05/20
vulnerability

openssl
ãƒªãƒ³ã‚¯
WebGLã®ï¼ˆå®Ÿè³ªçš„ã«ï¼‰ä»•æ§˜ä¸Šã®è„†å¼±æ€§ã«ã¤ã„ã¦(æ—¥æœ¬èªžè¨³) - ã‚‚ã®ãŒãŸã‚Š(æ—§)
WebGLã®ï¼ˆå®Ÿè³ªçš„ã«ï¼‰ä»•æ§˜ä¸Šã®è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã¨ã•ã‚Œã¦ã€è©±é¡Œã«ãªã£ã¦ã„ã¾ã™ã€‚å…ƒã¯Context Information Securityç¤¾ã®ãƒ–ãƒã‚°ã®è¨˜äº‹ãªã®ã§ã™ãŒã€ http://www.contextis.co.uk/resources/blog/webgl/ æ—¥æœ¬èªžã§ã‚‚ã‹ã„ã¤ã¾ã‚“ã§ç´¹ä»‹ã•ã‚Œã¦ã„ã¾ã™ã€‚ http://japan.cnet.com/news/service/35002505/ ã¨ã¯ã„ãˆã€ã“ã‚Œã˜ã‚ƒä½•ã ã‹æ„å‘³ãŒåˆ†ã‹ã‚Šã¾ã›ã‚“ã—ã€åŽŸæ–‡ã¯ãªã‹ãªã‹ç°¡å˜ã«ã¯èªã‚ãªã„ã¨æ€ã†ã®ã§ã€ã¡ã‚‡ã£ãã‚‰æ—¥æœ¬èªžè¨³ã—ã¦ã¿ã¾ã—ãŸã€‚å…¨ä½“çš„ã«ã‚„ã£ã¤ã‘ãªãŒã‚‰ã€å¾ŒåŠã¯ç‰¹ã«å¯ã¼ã‘ãªãŒã‚‰è¨³ã—ã¦ã„ã‚‹ã®ã§ã€ä½•ã‹ãŠã‹ã—ã„ã¨ã“ã‚ãŒã‚ã‚Šã¾ã—ãŸã‚‰ã‚³ãƒ¡ãƒ³ãƒˆç‰ã§æ•™ãˆã¦ä¸‹ã•ã„ã¾ã›ã€‚ç¿»è¨³è¨±è«¾ã¯æ˜Žæ—¥è¾ºã‚ŠãŠé¡˜ã„ã—ã¦ã¿ã‚ˆã†ã¨æ€ã„ã¾ã™ã€‚ï¼ˆãƒ€ãƒ¡ã£ã¦è¨€ã‚ã‚ŒãŸã‚‰æ¶ˆã™ï¼‰â†’ã‚‚ã‚‰ã„ã¾ã—ãŸã€‚èª¿æŸ»ã®æ¬¡ã®ãƒ©ã‚¦ãƒ³ãƒ‰ãŒçµ‚ã‚ã£ãŸã‚‰ã¾ãŸçµæžœã‚’æ•™ãˆã¦ãã‚Œã‚‹ã¿ãŸã„ã€‚ è¿½è¨˜:
nobu666 2011/05/12
security

webgl

vulnerability
ãƒªãƒ³ã‚¯
FAQ for YAMAHA Router Series / Security
IPã®å®Ÿè£…ã«ãŠã‘ã‚‹ã‚µãƒ¼ãƒ“ã‚¹é‹ç”¨å¦¨å®³(DoS)ã®è„†å¼±æ€§ã«ã¤ã„ã¦ ãƒ¤ãƒžãƒãƒ«ãƒ¼ã‚¿ãƒ¼ã‚·ãƒªãƒ¼ã‚ºã®IPã®å®Ÿè£…ã«è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹ã“ã¨ãŒåˆ†ã‹ã‚Šã¾ã—ãŸã€‚å¯¾è±¡ã¨ãªã‚‹æ©Ÿç¨®åŠã³å¯¾ç–æ–¹æ³•ã«ã¤ãã¾ã—ã¦ã¯ä¸‹è¨˜ã‚’ã”ç¢ºèªã„ãŸã ãã€å¿…è¦ãªå ´åˆã«ã¯å¯¾ç–ã‚’è¡Œã£ã¦ãã ã•ã„ã€‚ è„†å¼±æ€§ã¨ãã®æ¦‚è¦ JVN#55714408 ãƒ¤ãƒžãƒãƒ«ãƒ¼ã‚¿ãƒ¼ã‚·ãƒªãƒ¼ã‚ºã®Internet Protocol (IP) ã®å®Ÿè£…ã«ã¯ã€ä¸æ£ãªIPãƒ˜ãƒƒãƒ€ã‚ªãƒ—ã‚·ãƒ§ãƒ³ã‚’å‡¦ç†ã™ã‚‹ã“ã¨ã«èµ·å› ã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹é‹ç”¨å¦¨å®³ (DoS) ã®è„†å¼±æ€§ãŒå˜åœ¨ã—ã¾ã™ã€‚ IPãƒ˜ãƒƒãƒ€ã®ç‰¹å®šç®‡æ‰€ã«ä¸æ£ãªå€¤ãŒæŒ¿å…¥ã•ã‚Œã¦ã„ã‚‹ã¨ä¸æ£ãªãƒ¡ãƒ¢ãƒªé ˜åŸŸã‚’å‚ç…§ã—ã¦ã—ã¾ã†ãŸã‚ã€å ´åˆã«ã‚ˆã£ã¦ã¯ãƒªãƒ–ãƒ¼ãƒˆã™ã‚‹ã“ã¨ãŒã‚ã‚Šã¾ã™ã€‚ ãªãŠæœ¬è„†å¼±æ€§ã¯ã€ãƒ«ãƒ¼ã‚¿ãƒ¼ã«ç›´çµã•ã‚ŒãŸPCã‹ã‚‰ã®æ”»æ’ƒã«å¯¾ã—ã¦ã¯æˆç«‹ã™ã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ãŒã€ã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆçµŒç”±ã§ã®æ”»æ’ƒã«å¯¾ã—ã¦æˆç«‹ã™ã‚‹å¯èƒ½æ€§ã¯ä½Žã„ã¨åˆ¤æ–ã—ã¦ãŠã‚Šã¾ã™ã€‚å…·ä½“çš„ãªç†ç”±ã«ã¤ãã¾ã—ã¦ã¯ã€Œã‚¤ãƒ³ã‚¿ãƒ¼ãƒãƒƒãƒˆçµŒ
nobu666 2011/04/14
yamaha

router

security

vulnerability
ãƒªãƒ³ã‚¯
Spare Clock Cycles
Gmail+Google Chrome XSS Vulnerability The weekend before last, I found a flaw in Gmail that on the one hand was rather exciting for me (as I hadn't expected to find anything at all, and it was pretty clearly reward-worthy), but on the other was a little unnerving, given how quickly and easily I was able to find it and how serious the vulnerability was. Vulnerability Discovery While doing some work
nobu666 2011/02/04
vulnerability

google
ãƒªãƒ³ã‚¯
yebo blog: WPA2ã®è„†å¼±æ€§ã€ŒHole 196ã€
2010/07/25 WPA2ã®è„†å¼±æ€§ã€ŒHole 196ã€ ä»Šã¾ã§ã€802.1xèªè¨¼ã‚’æŒã¤WPA2 (AESæš—å·)ã¯ã‚‚ã£ã¨ãŠå®‰å…¨ãªç„¡ç·šLANã¨è¦‹ã‚‰ã‚Œã¦ã„ãŸãŒã€AirTight Networksã®ç ”ç©¶è€…ãŒã€ŒHole 196ã€ã¨åä»˜ã‘ã‚‰ã‚ŒãŸWPA2ã®è„†å¼±æ€§ã‚’ç™ºè¦‹ã—ã€Black Hatã¨Defconã§ç™ºè¡¨ã™ã‚‹ã¨ã®äº‹ã [networkworld, infosecurity]ã€‚ã“ã®è„†å¼±æ€§ãŒ1232ãƒšãƒ¼ã‚¸ã‚ã‚‹IEEE 802.11æ¨™æº–(2007å¹´ç‰ˆ)ã®196ãƒšãƒ¼ã‚¸ç›®ã«ã‚ãŸã‚‹ãŸã‚ã«ã€ŒHole 196ã€ã¨å‘¼ã°ã‚Œã‚‹ãã†ã ã€‚Hole 196ã¯MITMç³»ã®ã‚¨ã‚¯ã‚¹ãƒ—ãƒã‚¤ãƒˆã§ã€å†…éƒ¨ã‹ã‚‰WiFiãƒ¦ãƒ¼ã‚¶ã®æš—å·é€šä¿¡ã‚’è§£èªã—ã€ä¸æ£ãªãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’ç™ºç”Ÿã•ã›ã‚‹ã‚‚ã®ã¨ã®ã“ã¨ã€‚WPA2ã¯äºŒã¤ã®éµã‚’åˆ©ç”¨ã™ã‚‹ã€‚ä¸€ã¤ã¯PTK (Pairwise Transient Key) ã§å„ã‚¯ãƒ©ã‚¤ã‚¢ãƒ³ãƒˆæ¯Žã«ãƒ¦ãƒ‹ãƒ¼ã‚¯ãªéµã§ãƒ¦ãƒ‹ã‚ãƒ£ã‚¹ãƒˆãƒˆãƒ©ãƒ•ã‚£ãƒƒã‚¯ã‚’ä¿
nobu666 2010/07/26
wireless

vulnerability
ãƒªãƒ³ã‚¯
PNGç”¨ã®å…¬å¼ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€Œlibpngã€ã«ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã®è„†å¼±æ€§
ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ã‚»ãƒ³ã‚¿ãƒ¼ï¼ˆIPA/ISECï¼‰ãŠã‚ˆã³ä¸€èˆ¬ç¤¾å›£æ³•äºº JPCERT ã‚³ãƒ¼ãƒ‡ã‚£ãƒãƒ¼ã‚·ãƒ§ãƒ³ã‚»ãƒ³ã‚¿ãƒ¼ï¼ˆJPCERT/CCï¼‰ã¯7æœˆ6æ—¥ã€PNG Development GroupãŒæä¾›ã—ã¦ã„ã‚‹PNGç”¨ã®å…¬å¼ãƒ©ã‚¤ãƒ–ãƒ©ãƒªã€Œlibpngã€ã«ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã®è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹ã¨ã€ŒJapan Vulnerability Notesï¼ˆJVNï¼‰ã€ã§ç™ºè¡¨ã—ãŸã€‚ ã“ã®å•é¡ŒãŒæ‚ªç”¨ã•ã‚Œã‚‹ã¨ã€ç´°å·¥ã•ã‚ŒãŸPNGãƒ•ã‚¡ã‚¤ãƒ«ã‚’èªã¿è¾¼ã‚“ã å ´åˆã«ãƒãƒƒãƒ•ã‚¡ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ãŒå¼•ãèµ·ã“ã•ã‚Œã€ãƒ¦ãƒ¼ã‚¶ãƒ¼æ¨©é™ã§ãƒªãƒ¢ãƒ¼ãƒˆã‹ã‚‰ã‚³ãƒ¼ãƒ‰ã‚’å®Ÿè¡Œã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€‚æœ¬è„†å¼±æ€§ã®å½±éŸ¿ã‚’å—ã‘ã‚‹ã‚·ã‚¹ãƒ†ãƒ ã¯ã€ã€Œlibpng 1.4.3ã‚ˆã‚Šå‰ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€ã€Œlibpng 1.2.44ã‚ˆã‚Šå‰ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã€ã€Œlibpng 1.0.xã€ã¨ãªã£ã¦ã„ã‚‹ã€‚ ãªãŠã€PNG Development Groupã§ã¯ã“ã®è„†å¼±æ€§ã‚’è§£æ¶ˆã™ã‚‹æœ€æ–°ç‰ˆã‚’å…¬é–‹
nobu666 2010/07/08
vulnerability
ãƒªãƒ³ã‚¯
Office XPã«å«ã¾ã‚Œã‚‹è„†å¼±æ€§ã€ã€Œè¨‚æ£ä¸å¯èƒ½ã€ãªãŸã‚æ”¾ç½® | ã‚¹ãƒ©ãƒ‰ ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£
Microsoftã¯Office XP/2003/2007ã§ç™ºè¦‹ã•ã‚ŒãŸã€ã€Œé‡è¦ã€ã¨ã•ã‚Œã‚‹è„†å¼±æ€§ã€ŒMS10-036ã€ã«ã¤ã„ã¦ã€Office XPã«å¯¾ã—ã¦ã¯ä¿®æ£ãƒ‘ãƒƒãƒã‚’ãƒªãƒªãƒ¼ã‚¹ã—ãªã„ãã†ã ã€‚ç†ç”±ã¯ã€ŒOffice XPã®éžå¸¸ã«å¤šãã®éƒ¨åˆ†ã‚’å†åº¦è¨è¨ˆã—ç›´ã™å¿…è¦ãŒã‚ã‚‹ã€ãŸã‚ã€ã€Œä¿®æ£ãƒ—ãƒã‚°ãƒ©ãƒ ã‚’é–‹ç™ºã™ã‚‹ã“ã¨ã¯ä¸å¯èƒ½ã€ã ã‹ã‚‰ã ãã†ã ï¼ˆjapan.internet.comã®è¨˜äº‹ï¼‰ã€‚ãªãŠã€Office XPã¯ã¾ã å»¶é•·ã‚µãƒãƒ¼ãƒˆæœŸé–“ä¸ã§ã‚ã‚‹ãŸã‚ã€ã“ã‚Œä»¥å¤–ã®è„†å¼±æ€§ã«é–¢ã™ã‚‹å¯¾ç–ãƒ‘ãƒƒãƒã«ã¤ã„ã¦ã¯åŸºæœ¬çš„ã«ã¯ãƒªãƒªãƒ¼ã‚¹ã•ã‚Œã¦ã„ã‚‹ã€‚ è„†å¼±æ€§ã®ä¿®æ£ã‚’è«¦ã‚ã‚‹ã¨ã„ã†ã“ã¨ãŒè¨±ã•ã‚Œã‚‹ã®ã ã‚ã†ã‹ã€ã¾ãŸä¼¼ãŸã‚ˆã†ãªä¾‹ã‚’çŸ¥ã£ã¦ã„ãŸã‚‰æ•™ãˆã¦ã„ãŸã ããŸã„ã€‚
nobu666 2010/06/16
office

vulnerability
ãƒªãƒ³ã‚¯
WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼å¿…è¦‹ï¼WEBè„†å¼±æ€§åŸºç¤ŽçŸ¥è˜æœ€é€Ÿãƒžã‚¹ã‚¿ãƒ¼ - ç‡ˆæ˜Žæ—¥è¨˜
ä»¥ä¸‹ã¯ã€WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ç”¨ã®WEBè„†å¼±æ€§ã®åŸºç¤ŽçŸ¥è˜ã®ä¸€è¦§ã§ã™ã€‚ WEBãƒ—ãƒã‚°ãƒ©ãƒžãƒ¼ã®äººã¯ã“ã‚Œã‚’èªã‚ã°WEBè„†å¼±æ€§ã®åŸºç¤Žã‚’ãƒžã‚¹ã‚¿ãƒ¼ã—ã¦WEBãƒ—ãƒã‚°ãƒ©ãƒ ã‚’æ›¸ãã“ã¨ãŒã§ãã‚‹ã‚ˆã†ã«ãªã£ã¦ã„ã‚‹ã‹ã‚‚ã§ã™ã€‚ ã¾ãŸã€WEBè„†å¼±æ€§ã®ç°¡æ˜“ãƒªãƒ•ã‚¡ãƒ¬ãƒ³ã‚¹ã¨ã—ã¦ã‚‚å°‘ã—åˆ©ç”¨ã§ãã‚‹ã‹ã‚‚ã—ã‚Œã¾ã›ã‚“ã€‚ WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã™ã‚‹ã«ã¯ã€é–‹ç™ºè¦ä»¶æ›¸ã‚„ãƒ—ãƒã‚°ãƒ©ãƒ ä»•æ§˜æ›¸é€šã‚Šã«é–‹ç™ºã™ã‚Œã°è‰¯ã„ã¨ã„ã†ã‚ã‘ã«ã¯ã„ãã¾ã›ã‚“ã€‚ ãã†ã€WEBè„†å¼±æ€§ã‚’ç‹™ã†æ‚ªæ„ã®ãƒ¦ãƒ¼ã‚¶ã«ã‚‚å¯¾å‡¦ã—ãªã„ã¨ã„ã‘ãªã„ã®ã§ã™ã€‚ ä»Šå›žã€WEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³ã‚’é–‹ç™ºã«ã‚ãŸã£ã¦ã®WEBè„†å¼±æ€§ã‚’ã€ä»¥ä¸‹ã®ä¸€è¦§ã«ã¾ã¨ã‚ã¦ã¿ã¾ã—ãŸã€‚ ã“ã®ã¾ã¨ã‚ãŒWEBã‚¢ãƒ—ãƒªã‚±ãƒ¼ã‚·ãƒ§ãƒ³é–‹ç™ºã®å‚è€ƒã«ãªã‚Œã°å¹¸ã„ã§ã™ã€‚ ã‚¤ãƒ³ã‚¸ã‚§ã‚¯ã‚·ãƒ§ãƒ³ ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒ»ã‚¹ã‚¯ãƒªãƒ—ãƒ†ã‚£ãƒ³ã‚° ã‚»ãƒƒã‚·ãƒ§ãƒ³ãƒ»ãƒã‚¤ã‚¸ãƒ£ãƒƒã‚¯ ã‚¢ã‚¯ã‚»ã‚¹åˆ¶å¾¡ã‚„èªå¯åˆ¶å¾¡ã®æ¬ è½ ãƒ‡ã‚£ãƒ¬ã‚¯ãƒˆãƒªãƒ»ãƒˆãƒ©ãƒãƒ¼ã‚µãƒ«(Directory Traversal) CSRFï¼ˆ
nobu666 2010/05/10
web

summary

vulnerability
ãƒªãƒ³ã‚¯
Rubyã«ãƒ’ãƒ¼ãƒ—ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã®è„†å¼±æ€§ã€ä¿®æ£ç‰ˆã‚’ãƒªãƒªãƒ¼ã‚¹ | OSDN Magazine
ãƒ—ãƒã‚°ãƒ©ãƒŸãƒ³ã‚°è¨€èªžã€ŒRubyã€ã«ãƒ’ãƒ¼ãƒ—ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã®è„†å¼±æ€§ãŒè¦‹ã¤ã‹ã£ãŸã“ã¨ã‚’å—ã‘ã€ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å¯¾ç–ã‚’æ–½ã—ãŸæœ€æ–°ä¿®æ£ç‰ˆã€ŒRuby 1.9.1-p376ã€ãŒ2009å¹´12æœˆ7æ—¥ã€ã‚ªãƒ•ã‚£ã‚·ãƒ£ãƒ«ã‚µã‚¤ãƒˆã§å…¬é–‹ã•ã‚ŒãŸã€‚ã™ã¹ã¦ã®Ruby 1.9.1ãƒ¦ãƒ¼ã‚¶ãƒ¼ã«ã‚¢ãƒƒãƒ—ã‚°ãƒ¬ãƒ¼ãƒ‰ã™ã‚‹ã‚ˆã†æŽ¨å¥¨ã—ã¦ã„ã‚‹ã€‚ ç™ºè¦‹ã•ã‚ŒãŸè„†å¼±æ€§ã€ŒCVE-2009-4124ã€ã¯ã€String#ljustã€String#centerã€String#rjustã®ãƒ’ãƒ¼ãƒ—ã‚ªãƒ¼ãƒãƒ¼ãƒ•ãƒãƒ¼ã€‚ã‚ã‚‹ç¨€ãªã‚±ãƒ¼ã‚¹ã§ã€æ”»æ’ƒè€…ã«ä»»æ„ã®ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã‚’è¨±ã—ã¦ã—ã¾ã†ã¨ã„ã†ã€‚å¯¾è±¡ã¯Ruby 1.9.1ã®ã™ã¹ã¦ã®ãƒªãƒªãƒ¼ã‚¹ã§ã€1.8ç³»çµ±ã«ã¯å½±éŸ¿ã—ãªã„ã€‚ åŒæ™‚ã«å…¬é–‹ã—ãŸæœ€æ–°ç‰ˆã®Ruby 1.9.1-p376ã¯ã€1.9.1ç³»çµ±ã®ãƒ‘ãƒƒãƒãƒ¬ãƒ™ãƒ«ãƒªãƒªãƒ¼ã‚¹ã€‚CVE-2009-4124è„†å¼±æ€§ã®ã»ã‹ã€100å€‹è¶…ã®ãƒã‚°ä¿®æ£ã‚’è¡Œã£ãŸã€‚ä¸»ãªä¿®æ£ç‚¹ã¯ã€IRBã®æ‹¡å¼µã‚³ãƒžãƒ³ãƒ‰æ©Ÿèƒ½ã‚„ã€AIXã«ãŠã‘ã‚‹ãƒ“ãƒ«
nobu666 2009/12/09
ruby

security

vulnerability
ãƒªãƒ³ã‚¯
Windows XPã®TCP/IPå•é¡Œã«ã¯å¯¾å‡¦ã›ãšã€MicrosoftãŒè¡¨æ˜Ž
MicrosoftãŒæœˆä¾‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ±ã‚’æ”¹è¨‚ã—ã€Windows XPã«ã¯ã‚µãƒ¼ãƒ“ã‚¹å¦¨å®³ï¼ˆDoSï¼‰ã®è„†å¼±æ€§ãŒ2ä»¶å˜åœ¨ã™ã‚‹ãŒã€ãƒ‘ãƒƒãƒã¯æä¾›ã—ãªã„ã¨è¡¨æ˜Žã—ãŸã€‚ ç±³Microsoftã¯9æœˆ8æ—¥ã«å…¬é–‹ã—ãŸæœˆä¾‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ±ã®ã†ã¡ã€TCP/IPã®è„†å¼±æ€§ã«ã¤ã„ã¦è¨˜è¼‰ã—ãŸã€ŒMS09-048ã€ã®å†…å®¹ã‚’æ”¹è¨‚ã—ã€Windows XP SP2/3ã«å˜åœ¨ã™ã‚‹ã‚µãƒ¼ãƒ“ã‚¹å¦¨å®³ï¼ˆDoSï¼‰ã®è„†å¼±æ€§ã‚’è§£æ±ºã™ã‚‹ãƒ‘ãƒƒãƒã¯æä¾›ã—ãªã„ã¨è¡¨æ˜Žã—ãŸã€‚ æ”¹è¨‚å¾Œã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£æƒ…å ±ã€ŒMS09-048ã€ã«ã‚ˆã‚‹ã¨ã€Windows XP SP2/3ã«ã¯ã€TCP/IPã«é–¢ã™ã‚‹3ä»¶ã®è„†å¼±æ€§ã®ã†ã¡2ä»¶ã«ã¤ã„ã¦ã€DoSã®è„†å¼±æ€§ãŒå˜åœ¨ã™ã‚‹ã€‚ã“ã®å•é¡Œã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã®çŠ¶æ…‹ã§ã¯å½±éŸ¿ã‚’å—ã‘ãšã€æ·±åˆ»åº¦ã¯4æ®µéšŽã§æœ€ã‚‚ä½Žã„ã€Œæ³¨æ„ã€ãƒ¬ãƒ™ãƒ«ã¨ã—ã¦ã„ã‚‹ãŒã€ä¼æ¥ã§ã¯è¨å®šã«ã‚ˆã£ã¦è„†å¼±æ€§ãŒç”Ÿã˜ã‚‹ã“ã¨ãŒã‚ã‚‹ã¨ã„ã†ã€‚ ã“ã®è„†å¼±æ€§ã‚’çªãDoSæ”»æ’ƒã‚’å—ã‘ãŸå ´åˆã€ãƒ¡ãƒ¢ãƒªãŒæ¶ˆè²»ã•ã‚Œã¦ã‚·ã‚¹ãƒ†ãƒ ãŒåå¿œ
nobu666 2009/09/15
security

vulnerability

windows
ãƒªãƒ³ã‚¯
ä¸»è¦ãƒ–ãƒ©ã‚¦ã‚¶ã™ã¹ã¦ã«å½±éŸ¿ã™ã‚‹ã€Œã‚¯ãƒªãƒƒã‚¯ã‚¸ãƒ£ãƒƒã‚ãƒ³ã‚°ã€æ”»æ’ƒã¨ã¯
Windows SQL Server 2005ã‚µãƒãƒ¼ãƒˆçµ‚äº†ã®4æœˆ12æ—¥ãŒè¿«ã‚‹ã€å ±å‘Šæ¸ˆã¿è„†å¼±æ€§ã®æ·±åˆ»åº¦ã‚‚é«˜ãã€æ—©æ€¥ãªç§»è¡Œã‚’
nobu666 2009/03/04
browser

security

vulnerability
ãƒªãƒ³ã‚¯
FreeBSD ä»»æ„ã‚³ãƒ¼ãƒ‰å®Ÿè¡Œã‚„rootæ¨©é™ç²å¾—ã€JailæŠœã‘ã®è„†å¼±æ€§ | ã‚¨ãƒ³ã‚¿ãƒ¼ãƒ—ãƒ©ã‚¤ã‚º | ãƒžã‚¤ã‚³ãƒŸã‚¸ãƒ£ãƒ¼ãƒŠãƒ«
FreeBSD- The Power To Serve The FreeBSD Projectã¯23æ—¥(å”å®šä¸–ç•Œæ™‚)ã€FreeBSD-SA-08:12.ftpdã¨FreeBSD-SA-08:13.protoswã¨ã„ã†2ä»¶ã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å‹§å‘Šã‚’ç™ºè¡¨ã—ãŸã€‚ã©ã¡ã‚‰ã®è„†å¼±æ€§ã‚‚ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§æœ‰åŠ¹ã«ãªã‚‹æ©Ÿèƒ½ã§ã¯ãªã„ãŸã‚ä½¿ã£ã¦ã„ãªã„å ´åˆã«ã¯å•é¡Œãªã„ãŒã€æ©Ÿèƒ½ã‚’æœ‰åŠ¹ã«ã—ã¦ã„ã‚‹å ´åˆã«ã¯æ·±åˆ»ãªå•é¡Œã«ã¤ãªãŒã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã€‚ã©ã¡ã‚‰ã®å•é¡Œã‚‚ã‚µãƒãƒ¼ãƒˆã•ã‚Œã¦ã„ã‚‹ã™ã¹ã¦ã®ãƒªãƒªãƒ¼ã‚¹ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«å½±éŸ¿ãŒã‚ã‚‹ã€‚ ftpd(8)ã¯ãƒ™ãƒ¼ã‚¹ã‚·ã‚¹ãƒ†ãƒ ã«ãƒžãƒ¼ã‚¸ã•ã‚Œã¦ã„ã‚‹æ±Žç”¨ç›®çš„ã®FTPã‚µãƒ¼ãƒã ãŒã€ä»Šå›žftpd(8)ã«ç‰¹å®šã®ã‚³ãƒžãƒ³ãƒ‰ã‚’ä½¿ã†ã“ã¨ã§ã‚¯ãƒã‚¹ã‚µã‚¤ãƒˆãƒªã‚¯ã‚¨ã‚¹ãƒˆå½è£…æ”»æ’ƒã«ä½¿ã‚ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚‹ã“ã¨ãŒæ˜Žã‚‰ã‹ã«ãªã£ãŸã€‚ftpd(8)ã¯ãƒ‡ãƒ•ã‚©ãƒ«ãƒˆã§ã¯æœ‰åŠ¹ã«ãªã£ã¦ã„ãªã„ã‚µãƒ¼ãƒ“ã‚¹ã€‚æ˜Žç¤ºçš„ã«ftpd(8)ã‚’æœ‰åŠ¹ã«ã—ã¦ã„ã‚‹å ´åˆã«ã¯å¯¾å¿œãŒå¿…è¦ã€‚ ã‚‚ã†ä¸€ã¤ã®è„†å¼±
nobu666 2009/01/14
vulnerability

freebsd
ãƒªãƒ³ã‚¯
About Secunia Research | Flexera
nobu666 2008/03/25
browser

safari

security

vulnerability

windows
ãƒªãƒ³ã‚¯
ã€ŒLhaplusã€ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å¼±ç‚¹ï¼ˆè„†å¼±æ€§ï¼‰ã®æ³¨æ„å–šèµ·ã«ã¤ã„ã¦ï¼šIPA ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹
ç‹¬ç«‹è¡Œæ”¿æ³•äºº æƒ…å ±å‡¦ç†æŽ¨é€²æ©Ÿæ§‹ï¼ˆç•¥ç§°ï¼šIPAã€ç†äº‹é•·ï¼šè—¤åŽŸæ¦å¹³å¤ªï¼‰ã¯ã€ã€ŒLhaplusã€ã«ãŠã‘ã‚‹ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£ä¸Šã®å¼±ç‚¹ï¼ˆè„†å¼±æ€§ï¼‰ã«é–¢ã™ã‚‹æ³¨æ„å–šèµ·ã‚’2007å¹´11æœˆ22æ—¥ã«å…¬è¡¨ã—ã¾ã—ãŸã€‚ ã“ã‚Œã¯ã€ç´°å·¥ã•ã‚ŒãŸãƒ•ã‚¡ã‚¤ãƒ«ã«å¯¾ã—ã¦å±•é–‹å‡¦ç†ã‚’è¡Œã£ãŸå ´åˆã«ã€ä»»æ„ã®ã‚³ãƒ¼ãƒ‰ãŒå®Ÿè¡Œã•ã‚Œã‚‹ã¨ã„ã†ã‚‚ã®ã§ã™ã€‚æ‚ªç”¨ã•ã‚Œã‚‹ã¨ã€ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ä¸Šã§ãƒ¦ãƒ¼ã‚¶ã®æ„å›³ã—ãªã„ãƒ—ãƒã‚°ãƒ©ãƒ ã®å®Ÿè¡Œã‚„ã€ãƒ•ã‚¡ã‚¤ãƒ«ã®å‰Šé™¤ã€ã‚¦ã‚¤ãƒ«ã‚¹ã‚„ãƒœãƒƒãƒˆãªã©ã®æ‚ªæ„ã‚ã‚‹ãƒ„ãƒ¼ãƒ«ãŒã‚¤ãƒ³ã‚¹ãƒˆãƒ¼ãƒ«ã•ã‚Œã‚‹ãªã©ã€ã‚³ãƒ³ãƒ”ãƒ¥ãƒ¼ã‚¿ãŒæ‚ªæ„ã‚ã‚‹ãƒ¦ãƒ¼ã‚¶ã«ã‚ˆã£ã¦åˆ¶å¾¡ã•ã‚Œã‚‹å¯èƒ½æ€§ãŒã‚ã‚Šã¾ã™ã€‚ å¯¾ç–æ–¹æ³•ã¯ã€Œãƒ™ãƒ³ãƒ€ãŒæä¾›ã™ã‚‹å¯¾ç–æ¸ˆã¿ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã«æ›´æ–°ã™ã‚‹ã€ã“ã¨ã§ã™ã€‚ Lhaplusã¯ã€é›»åãƒ•ã‚¡ã‚¤ãƒ«ã®ãƒ‡ãƒ¼ã‚¿ã‚µã‚¤ã‚ºã‚’å°ã•ãã™ã‚‹ã“ã¨ãªã©ã‚’ç›®çš„ã«ã€ãƒ‡ãƒ¼ã‚¿ã‚’åœ§ç¸®ã—ã¦ä¿å˜ã—ãŸã‚Šã€ã¾ãŸãã®åœ§ç¸®ã—ãŸãƒ‡ãƒ¼ã‚¿ã‚’å…ƒã®ãƒ‡ãƒ¼ã‚¿ã«æˆ»ã—ãŸã‚Šã™ã‚‹æ©Ÿèƒ½ã‚’æŒã¤ã‚½ãƒ•ãƒˆã‚¦ã‚§ã‚¢ã®ä¸€ã¤ã§ã™ã€‚LhaplusãŒå¯¾å¿œã™ã‚‹åœ§ç¸®å½¢å¼ã«ã¯ã€lzhå½¢å¼ã‚„z
nobu666 2007/11/22
security

vulnerability
ãƒªãƒ³ã‚¯
Leopardã®Mail.appã«è„†å¼±æ€§ | Macin' Blog
å°‘ã—ãŠç²—æœ«ãªæ„Ÿã˜ã‚‚ã—ã¾ã™ãŒï¼ŒTigerã®æ™‚ã«ä¸€åº¦ã¯å¡žã„ã è„†å¼±æ€§ãŒï¼ŒLeopardã«ãªã£ã¦å¾©æ´»ã—ãŸã‚‰ã—ã„ï¼Ž ITmediaã«ã‚ˆã‚‹ã¨ï¼ŒAppleãŒ2006å¹´ã«ä¿®æ£ã—ãŸã¯ãšã®Mail.appã®ã‚»ã‚ãƒ¥ãƒªãƒ†ã‚£å•é¡ŒãŒMac OS X 10.5ã€€Leopardã§å¾©æ´»ã—ã¦ã„ã‚‹ãã†ã§ã™ï¼Ž ã“ã‚ŒãŒæ‚ªç”¨ã•ã‚Œã‚‹ã“ã¨ã«ã‚ˆã£ã¦ï¼Œæ”»æ’ƒè€…ãŒãƒ¡ãƒ¼ãƒ«ã«ä¸æ£ã‚³ãƒ¼ãƒ‰ã‚’æŒ¿å…¥ã™ã‚‹ã“ã¨ãŒå¯èƒ½ã«ãªã‚‹ã‚‰ã—ãï¼Œæ‚ªæ„ã®ã‚ã‚‹ã‚³ãƒ¼ãƒ‰ã‚’å˜ãªã‚‹JPEGç”»åƒãƒ•ã‚¡ã‚¤ãƒ«ã«è¦‹ã›ã‹ã‘ã¦ï¼ŒçŸ¥ã‚‰ãšã«ãƒ€ãƒ–ãƒ«ã‚¯ãƒªãƒƒã‚¯ã™ã‚‹ã¨TerminalãŒé–‹ã‹ã‚Œã¦ã‚·ã‚§ãƒ«ã‚¹ã‚¯ãƒªãƒ—ãƒˆãŒå®Ÿè¡Œã•ã‚Œã‚‹ãã†ã§ã™ï¼Ž å ±å‘Šã•ã‚ŒãŸã®ãŒ11æœˆ20æ—¥ã§ï¼Œã™ã§ã«Mac OS X 10.5.1ã®ã‚¢ãƒƒãƒ—ãƒ‡ãƒ¼ã‚¿ã¯å‡ºã¦ã„ãŸã“ã¨ã‹ã‚‰ï¼Œæœ€æ–°ã®ãƒãƒ¼ã‚¸ãƒ§ãƒ³ã§ã‚‚ä¿®æ£ã•ã‚Œã¦ã„ãªã„ã‚‚ã®ã¨æ€ã‚ã‚Œã¾ã™ï¼Ž ã¨ã„ã†ã“ã¨ã§ï¼Œä»Šã®ã¨ã“ã‚ã®å¯¾å‡¦æ–¹æ³•ã¯ã‚¢ãƒ¤ã‚·ã‚¤æ·»ä»˜ç”»åƒã‚’é–‹ã‹ãªã„ã“ã¨ï¼Ž
nobu666 2007/11/22
mac

security

vulnerability
ãƒªãƒ³ã‚¯
1