News & Commentary

Content tagged with Compliance posted in October 2016
US Should Help Private Sector 'Active Defense,' But Outlaw Hacking Back, Says Task Force
News  |  10/31/2016  | 
Task Force at George Washington University suggests ways for government to clear up legal quagmires, improve tools, keep us all out of trouble.
Preparing For Government Data Requests After Apple Vs. FBI
Preparing For Government Data Requests After Apple Vs. FBI
Dark Reading Videos  |  10/31/2016  | 
Jennifer Granick and Riana Pfefferkorn discuss lessons learned from the Apple-FBI case, and how security pros should be prepared if government data requests hit closer to home.
Yahoo Demands Government Be More Transparent About Data Requests
Quick Hits  |  10/20/2016  | 
In a letter to the Director of National Intelligence, the tech company says this transparency would also help clear Yahoo's name in customer email scan case.
US Bank Regulators Draft Rules For Financial Services Cybersecurity
Quick Hits  |  10/20/2016  | 
Proposed standards will require financial firms to recover from any cyberattack within two hours.
California Victims Of Yahoo Breach Pursue Claims In State, Not Federal Court
News  |  10/17/2016  | 
Plaintiffs hope to benefit from California's history of stricter cybersecurity and data privacy law.
G7 Nations Plan To Team Up To Tackle Financial Cybercrime
Quick Hits  |  10/12/2016  | 
Group of Seven nations new guidelines include sharing updates by governments, private firms and regulators, plus joint address of shortfalls.
20 Questions To Explore With Security-as-a-Service Providers
Commentary  |  10/5/2016  | 
This list will help you leverage the niche expertise of security-as-a-service providers, and assess which vendor can best meet your needs
Grading Obama: D-
President Failed To Protect Us From The Bad Guys
Commentary  |  10/3/2016  | 
A barely passing grade from a former special agent in charge of the NYC FBI cybercrimes division for failing to create deterrents and policies that encourage self defense.
Grading Obama: C+
Administration Missed Key Opportunities To Civilize Cyberspace
Commentary  |  10/3/2016  | 
A middling grade because the President's cyber policy initiatives were reactive, laisse faire, and didnt buttress American economic opportunity.


Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Why CISOs Need a Security Reality Check
Joel Fulton, Chief Information Security Officer for Splunk,  6/13/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12557
PUBLISHED: 2018-06-19
An issue was discovered in Zuul 3.x before 3.1.0. If nodes become offline during the build, the no_log attribute of a task is ignored. If the unreachable error occurred in a task used with a loop variable (e.g., with_items), the contents of the loop items would be printed in the console. This could ...
CVE-2018-12559
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The mount target path check in mounter.cpp `mpOk()` is insufficient. A regular user can consequently mount a CIFS filesystem anywhere (e.g., outside of the /home directory tree) by passing directory traversal sequ...
CVE-2018-12560
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. Arbitrary unmounts can be performed by regular users via directory traversal sequences such as a home/../sys/kernel substring.
CVE-2018-12561
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. A regular user can inject additional mount options such as file_mode= by manipulating (for example) the domain parameter of the samba URL.
CVE-2018-12562
PUBLISHED: 2018-06-19
An issue was discovered in the cantata-mounter D-Bus service in Cantata through 2.3.1. The wrapper script 'mount.cifs.wrapper' uses the shell to forward the arguments to the actual mount.cifs binary. The shell evaluates wildcards (such as in an injected string:/home/../tmp/* string).