New Security Publication was published by Xavier Roussel, Junior Security Analyst at High-Tech Bridge: In-Memory Fuzzing with Java.
More links about Fuzzing:
Direct link to download PDF: In-Memory Fuzzing in JAVA (1,0 MB).
High-Tech Bridge is pleased to announce CVSSv2 Calculator for vulnerabilities in web applications.
The Common Vulnerability Scoring System (CVSS) provides an open framework for communicating the characteristics and impacts of IT vulnerabilities.
Read more: A Complete Guide to the Common Vulnerability Scoring System Version 2.0.
High-Tech Bridge is pleased to celebrate its fifth anniversary on December 12, 2012. We are grateful to all the customers for their loyalty and trust. On this remarkable date, High-Tech Bridge is also proud to partially uncover its innovative in-house product named ImmuniWeb®, expected by many customers, partners and journalists for almost one year.
Ilia Kolochenko, CEO, briefs about it:
"Our fifth year of continuous growth proves that we are doing the right thing and our business strategy is correct. Finally, we are ready to launch ImmuniWeb®, a product that is aimed to change our market towards simplicity, integrity and accessibility for Small and Medium Businesses, who were unfairly prevented from testing their security by high market prices and administrative difficulties. We have invested several million dollars and almost 3 years into its development, and now we are ready to present it to the public. The official sales of ImmuniWeb® Beta will start on the 15th of January 2013 for all the customers in Switzerland, and for the holders of invite-codes abroad. Later the product will be available worldwide without limitations. We have already registered the trademark in 36 countries. For the moment that's all I can say about ImmuniWeb®, more information is coming soon. Stay with us."
High-Tech Bridge will offer special discounts for ImmuniWeb® to all its customers. If you are located abroad please contact your High-Tech Bridge's Account Manager by e-mail to get an invite-code.
About High-Tech Bridge
High-Tech Bridge SA provides multinational companies, financial institutions, and international organizations with edge-cutting information security, penetration testing and ethical hacking services. In 2012 Frost & Sullivan's market research has recognized High-Tech Bridge as one of the market leaders and best service providers in the ethical hacking.
Contacts
Mr. Sebastien Flaccavento
Tel.: +41-22-560-68-43
E-Mail: press@htbridge.com
Twitter: https://twitter.com/htbridge
Facebook: https://www.facebook.com/htbridge
Smartphone Pentest Framework (SPF) versions 0.1.3, 0.1.4 suffers from OS Command Injection [CWE-78]. High-Tech Bridge Security Research Lab discovered multiple vulnerabilities (Multiple OS Command Execution Vulnerabilities) in Smartphone Pentest Framework (SPF), which could be exploited to get control over a penetration testers's machine remotely.
According to High-Tech Bridge's Advisory HTB23127, multiple Perl scripts in the "/frameworkgui/" directory do not perform sanitation of user-supplied input passed as argument to the "system()" function, so that it becomes possible to inject and execute arbitrary OS commands on the target system with privileges of the web server user.
Due to unfixed CSRF vulnerability (3) in HTB23123 is possible exploit the vulnerabilities, exists in "SEAttack.pl" script (due to insufficient validation of user-supplied input passed via the "hostingPath" parameter), "CSAttack.pl" script due to insufficient validation of user-supplied input passed via the "hostingPath", "attachMobileModem.pl" script due to insufficient validation of user-supplied input passed via the "appURLPath".
This vulnerabilities are unpatched at this time, as a temporary solution remove or disable SPF's GUI.
Full advisory: High-Tech Bridge Advisory HTB23127 - Multiple Vulnerabilities in Smartphone Pentest Framework (SPF).
High-Tech Bridge Security Research Lab has discovered 2 remote DoS vulnerabilities in TVMOBiLi Media server, which could be exploited to crash remote server with malicious HTTP requests.
Due to improper handling of length parameter inconsistency [CWE-130] TVMOBiLi was vulnerable to perform DoS attacks.
Brief description of vulnerabilities:
The vulnerabilities exists due to improper handling of URI length within the "HttpUtils.dll" dynamic-link library. A remote attacker can send a specially crafted HTTP GET request of 161, 257 or 255 characters long, or 255, 257 or 260 characters long to 30888/TCP port (default TVMOBiLi's server port) and cause a stack-based buffer overrun that will crash tvMobiliService service.
TVMOBiLi is a free Media server for Mac, Windows, and Linux OS that enables your computer to communicate with a myriad of modern devices in your home using the power of UPnP.
Solution:
Vulnerabilities are now fixed in TVMOBiLi 2.1.0.3974
References:
Multiple SQL injection vulnerabilities were found in ClipBucket, free and opensource video sharing script. Full details of vulnerabilities with Proof-of-Concept examples are available on High-Tech Bridge Security Research Lab's page: High-Tech Bridge Advisory HTB23125: Multiple SQL Injection vulnerabilities in ClipBucket.
Vulnerable scripts list: "ajax.php", "/user_contacts.php", "/view_channel.php", "view_page.php", "view_topic.php", "/watch_video.php".As noticed on researcher's page, some of this vulnerabilities were described early for previous versions of ClipBucket, however they were not fixed in the tested version (2.6 Revision 738).
Now solution is available: apply CB SQL Injection Fix 11282012 patch or upgrade to ClipBucket 2.6 r738 with security fixes (clipbucket-2.6-r738-security-fixed-p2). This files are available in download area of ClipBucket's SourceForge page.
Multiple security vulnerabilities (HTB23126) are found in Achievo version 1.4.5.
Achievo is flexible web-based resource management software that is suitable for any medium sized company that needs to keep track of its resources, projects, clients, contacts, planning and daily scheduling.
References:
