New answers tagged

1

I strongly disagree that devices or software with lots of published vulnerabilities are therefore less secure than those with few. And advocating that as means of determining quality is to endorse practice of keeping vulnerabilities secret. While this does not apply to end-user maintained systems: A large proportion of vulnerabilities can be mitigated with ...


2

Besides searching CERT, what other methods are available to help accomplish this task? Look for vendor specific patterns and penelize any vendors which have lots of vulnerabilities take a lot of time for fixes expire products too quickly, i.e. make them obsolete after only few years and stop supporting them make it hard for you to find the updates ...


2

I don't think, there was any vulnerability in this, at least not in openssh. The code resulting in this error was added in this commit and it is referencing recommendation from ietf-drafts. Probably RFC4252, which states today: The 'user name' and 'service name' are repeated in every new authentication attempt, and MAY change. The server ...


0

Apple has released the Security Update 2014-005, disabling the CBC mode with SSLv3: Security Update 2014-005 Secure Transport Available for: OS X Mountain Lion v10.8.5, OS X Mavericks v10.9.5 Impact: An attacker may be able to decrypt data protected by SSL Description: There are known attacks on the confidentiality of SSL ...


0

Security Tracker has a search capability to comb multiple sources for reported vulnerabilities: http://securitytracker.com/search/search.html Good luck! edit: sorry, ST doesn't search eternal sites, everything is internal to ST itself. I personally use it as one information source (free version). Not sure why I'm getting down voted.


3

I did something similar a while back to ensure we were keeping up with security updates. It's all manual, though: I can't help you automate it but I can tell you how long it took me and give an example of what I ended up using. The initial setup took a couple days (we use > 75 libraries), and since then it's just been an hour or less per week to maintain it ...



Top 50 recent answers are included