SUSE Security Update: Security update for WebYaST
______________________________________________________________________________

Announcement ID:    SUSE-SU-2013:0053-1
Rating:             important
References:         #792712
Cross-References:   CVE-2012-0435
Affected Products:
                    WebYaST 1.2
                    SUSE Studio Standard Edition 1.2
______________________________________________________________________________

   An update that fixes one vulnerability is now available. It
   includes one version update.

Description:


   The hosts list used by WebYaST for connecting to it's back
   end part was  modifiable allowing to point to a malicious
   website which then could access  all values sent by WebYaST.

   The /host configuration path was removed to fix this issue.

   Security Issue reference:

   * CVE-2012-0435
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0435
   >


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - WebYaST 1.2:

      zypper in -t patch slewyst12-webyast-base-ui-7236

   - SUSE Studio Standard Edition 1.2:

      zypper in -t patch sleslms12-webyast-base-ui-7236

   To bring your system up-to-date, use "zypper patch".


Package List:

   - WebYaST 1.2 (noarch) [New Version: 0.2.63]:

      webyast-base-ui-0.2.63-0.6.1
      webyast-base-ui-branding-default-0.2.63-0.6.1
      webyast-base-ui-testsuite-0.2.63-0.6.1

   - SUSE Studio Standard Edition 1.2 (noarch) [New Version: 0.2.63]:

      webyast-base-ui-0.2.63-0.6.1


References:

   http://support.novell.com/security/cve/CVE-2012-0435.html
   https://bugzilla.novell.com/792712
   http://download.novell.com/patch/finder/?keywords=7c947289145036c838e04ef674b59d7b

IT security jobs: What's in demand and how to meet it

Posted on 15 May 2013.  |  Let's say you want a career in information security, where do you start? What credentials do you need? What are employers looking for? Read on to find some answers.

Is Microsoft is reading your Skype communications?

Posted on 15 May 2013.  |  The question of whether Skype allows U.S. intelligence and law enforcement agencies to access the communications exchanged by its users has still not been adequately answered by Microsoft.

Internet Explorer best at blocking malware

Posted on 14 May 2013.  |  While Chrome’s malware download protection improved significantly, Internet Explorer 10 continues to outperform the other browsers with a block rate of 99.96%.

Researcher refuses to help Saudi telco to spy on people

Posted on 14 May 2013.  |  You would think that a Saudi Arabian telecom firm interested in monitoring its users' mobile communications would not be asking a well-known pro-privacy researcher for help, but you would be wrong.

Malicious browser extensions are hijacking Facebook accounts

Posted on 13 May 2013.  |  Facebook users - especially those in Brazil - are being targeted with malicious browser extensions trying to hijack Facebook profiles, warns Microsoft.