Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

7/30/2009
02:01 PM
John H. Sawyer
John H. Sawyer
Commentary
50%
50%

Pwnie Awards Bring Fame And Shame

The third annual Pwnie Awards at Black Hat in Las Vegas, hosted by Alex Sotirov, Dino Dai Zovi, HD Moore, Halvar Flake, and Rich, celebrated the highs and lows in the security industry. As Dino said, "First we reward for great work, then we shame."

The third annual Pwnie Awards at Black Hat in Las Vegas, hosted by Alex Sotirov, Dino Dai Zovi, HD Moore, Halvar Flake, and Rich, celebrated the highs and lows in the security industry. As Dino said, "First we reward for great work, then we shame."I had a blast, and the presenters obviously enjoyed themselves when presenting each award, which are My Little Ponies that have been painted gold (picture on Pwnie Awards site). The presenters took the time to describe each nominee in detail, and it was interesting to hear the thoughts of the experts as they covered each one.

Alex noted that all of the nominees came from people in the industry and that several of the judges received nominations but had to disqualify themselves because of obvious reason.

Adobe received a lot of abuse for their repeated failures this year with Acrobat and Flash vulnerabilities, and as Dino so aptly pointed out it's a reader, it doesn't need to write to the file system.

The results will be posted to the Pwnie Awards site later today, but here is the unofficial list. (UPDATE: The Pwnie site has been updated with the winners.)

    Best Server-Side Bug - Linux SCTP FWD Chunk Memory Corruption

    Best Client-Side Bug - msvidctl.dll MPEG2TuneRequest Stack buffer overflow

    Best Privilege Escalation Bug - Linux udev Netlink Message Privilege Escalation

    Mass 0wnage - Red Hat Networks Backdoored OpenSSH Packages

    Most Innovative Research - From 0 to 0day on Symbian

    Lamest Vendor Response - Linux for continually assuming that all kernel memory corruption bugs are only Denial-of-Service

    - Juniper got an honorable mention for pulling Barnaby Jack's talk. Most Overhyped Bug

    - MS08-067 Server Service NetpwPathCanonicalize() Stack Overflow (CVE-2008-4250)

    Best Song - Nice Report by Doctor Raid

    Most Epic FAIL - Twitter Gets Hacked and the "Cloud Crisis"

    Lifetime Achievement Award - Solar Designer

John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25159
PUBLISHED: 2020-11-24
499ES EtherNet/IP (ENIP) Adaptor Source Code is vulnerable to a stack-based buffer overflow, which may allow an attacker to send a specially crafted packet that may result in a denial-of-service condition or code execution.
CVE-2020-25654
PUBLISHED: 2020-11-24
An ACL bypass flaw was found in pacemaker before 1.1.24-rc1 and 2.0.5-rc2. An attacker having a local account on the cluster and in the haclient group could use IPC communication with various daemons directly to perform certain tasks that they would be prevented by ACLs from doing if they went throu...
CVE-2020-28329
PUBLISHED: 2020-11-24
Barco wePresent WiPG-1600W firmware includes a hardcoded API account and password that is discoverable by inspecting the firmware image. A malicious actor could use this password to access authenticated, administrative functions in the API. Affected Version(s): 2.5.1.8, 2.5.0.25, 2.5.0.24, 2.4.1.19.
CVE-2020-29053
PUBLISHED: 2020-11-24
HRSALE 2.0.0 allows XSS via the admin/project/projects_calendar set_date parameter.
CVE-2020-25640
PUBLISHED: 2020-11-24
A flaw was discovered in WildFly before 21.0.0.Final where, Resource adapter logs plain text JMS password at warning level on connection error, inserting sensitive information in the log file.