[CERT-daily] Tageszusammenfassung - Mittwoch 20-02-2013

[Daily end-of-shift report]

=======================
= End-of-Shift report =
=======================

Timeframe:   Dienstag 19-02-2013 18:00 − Mittwoch 20-02-2013 18:00
Handler:     Stephan Richter
Co-Handler:  Christian Wojner



*** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-13:01.bind ***
---------------------------------------------
FreeBSD Security Advisory FreeBSD-SA-13:01.bind
---------------------------------------------
http://www.securityfocus.com/archive/1/525732




*** Bugtraq: FreeBSD Security Advisory FreeBSD-SA-13:02.libc ***
---------------------------------------------
FreeBSD Security Advisory FreeBSD-SA-13:02.libc
---------------------------------------------
http://www.securityfocus.com/archive/1/525735




*** Oracle stopft Sicherheitslecks: Updates für Java 1.4 bis 7 ***
---------------------------------------------
Oracle hat erneut ein Update für die Java-Laufzeitumgebung veröffentlicht. Es schliesst fünf Sicherheitslücken, drei davon mit der höchsten Gefährdungsstufe. Auch die Schwachstelle "Lucky 13" soll beseitigt sein. Weitere Patches sollen im April folgen.
---------------------------------------------
http://rss.feedsportal.com/c/32407/f/463925/s/28c21278/l/0L0Sheise0Bde0Csecurity0Cmeldung0COracle0Estopft0ESicherheitslecks0EUpdates0Efuer0EJava0E10E40Ebis0E70E180A65220Bhtml0Cfrom0Crss0A9/story01.htm




*** Apple FINALLY fills gaping Java hole that pwned its own devs ***
---------------------------------------------
Zero-day vuln also downed Facebook staff and other Mac users Apple has belatedly patched a security hole in the Java engine it ships with Mac OS X - the very hole exploited by hackers to infect Apples own developers, their counterparts at Facebook and scores of other Mac-using companies.
---------------------------------------------
http://go.theregister.com/feed/www.theregister.co.uk/2013/02/20/apple_java_omnishambles/




*** CloudFlare vs Incapsula vs ModSecurity - A Comparative Penetration Testing Analysis Report ***
---------------------------------------------
This document contains the results of a comparative penetration test
conducted by a team of security specialists at Zero Science Lab against
three 'leading' web application firewall solutions. Our goal was to
bypass security controls in place, in any way we can, circumventing
whatever filters they have. This report also outlines the setup and
configuration process, as well as a detailed security assessment.
---------------------------------------------
http://zeroscience.mk/files/wafreport2013.pdf