GeekyGuy writes:  

With the Holidays fast approaching, there is a new security issue you should be aware of. Please watch out for people standing near you in the checkout lines with cell phones. These camera phones will allow them to 'photograph' your credit card. They will have your card number, your name, and the expiration date.

This is one of the fastest growing scams this year, so please try to be aware of your surroundings, and the people standing close to you. And please mention this to your friends, to help keep them safer also.

kguske writes:  

From Netcraft:

Hackers have compromised the download server for the open source PostNuke content management system, redirecting users to malicious code in place of the .zip download of the PostNuke program. The hacked code was distributed for more than 32 hours before PostNuke site maintainers addressed the security breach. Read More...

dmolavi writes:  

NukedGallery.net has made available a list of over 13000 IP addresses that should be banned from accessing your phpNuke systems. Most are the results of failed SQL injections, UNION exploits, etc, and others are a result of attempting to access sealed ports on the server. The file can be found here (registration required to prevent bandwidth leaching bots, sorry :( ). This file is updated every night, and usually has at least two dozen new additions with each update (see the trend here).


This is a list of raw IP addresses to be entered into either iptables, or your .htaccess file (remember, Apache does not obey the hosts.deny file).

southern writes:  

Open source database users face new threat.


By Matthew Broersma, Techworld

Users of the increasingly popular, open-source MySQL database may be at risk from remote attacks due to a bug in phpMyAdmin, a widely used Web-based MySQL administration tool.

On Wednesday the phpMyAdmin project warned of a bug in the way the tool's MIME-based transformation system handles "external" transformations. Attackers could exploit the hole to execute arbitrary commands on a Web server with the privileges of the server's user, the project said in a statement.

A patch available on the phpMyAdmin site fixes the bug.

The vulnerability can only be exploited on systems where PHP's safe mode is turned off. Danish security firm Secunia said the flaw is serious, giving it a "highly critical" ranking.

The new flaw is the most serious to have been uncovered in phpMyAdmin to date; previous bugs, including some allowing configuration manipulation, code injection and cross site scripting, have been only moderately dangerous, according to security researchers.

PhpMyAdmin has become the de facto standard for controlling MySQL databases over a Web-based interface, though it faces numerous competitors. Like MySQL it is distributed under an open-source licence.

MySQL, like some other open-source databases, has gained ground in the database market, particularly in small to medium-sized businesses, industry analysts say. Enterprises are also beginning to eye the product as an alternative to Oracle.

http://www.techworld.com/security/news/index.cfm?NewsID=2419

BobMarion writes " After a long talk the other night with DJMaze the code below will secure PHP-Nuke 7.5's module admins. DJMaze voiced his concern that my site might be open to those hacks so we brain stormed the quickest fix, NukeSentinel(tm) 2.1.0 carries this patch but since it is still a few days away I wanted everyone to secure their sites!

Place this at the begining of your admin.php after the opening < ?php tag, if your using NukeSentinel(tm) place it right after the opening < ?php tag in includes/sentinel.php instead.

if($aid AND (!isset($admin) OR empty($admin)) AND $op!='login') { unset($aid); unset($admin); }

Note: NukeSentinel(tm) 2.0.2 has been updated to include this fix. You only need to reupload the includes/sentinel.php file."

PHP-Nuke Patched has been moved up to version 2.6 and a patch for PHP-Nuke 7.5 is now available, users of Nuke 7.5 can keep their site as is if desired as no major changes will be found on its patch, just a few bug fixes that didn't make it into 7.5 and the use of SCRIPT_NAME which is not used in core PHP-Nuke. Those already using Nuke Patched can manually update by applying anything described in the changelog forum at NukeFixes that may have been posted after the release date of version 2.5.

Download links available in the front page of NukeSecurity, NukeResources and NukeFixes among other websites including this one.