Gladiator Research and Security

GSA Reference Number: AD080317-01

Simply Put: Alt-N MDaemon’s IMAP Server is vulnerable to a remote buffer overflow. The IMAP server’s FETCH command does not perform boundary checking on user input. Successful exploitation could result in compromise of the affected system.

• Continue reading

GSA Reference Number: AD080116-01

Simply Put: A new phishing attack has been targeted to customers of a financial institution in Italy. This attack is unique because it links to the institution’s actual website instead of using a fake website like most phishing attacks. Once the customer clicks on the link in the email, they are directed to the institution’s website to log on. However, an attack embedded within the link allows the attacker to capture the username and password as the user logs in. The username and password are recorded by the attacker for future use.

• Continue reading

GSA Reference Number: AD071211-01

Simply Put: A notice has been sent out on a vulnerability in the SonicWALL Global VPN Client. This client is used on computers outside the organization, such as home PCs and laptops, to connect back to the corporate network. This is not a vulnerability affecting the firewall. If a user downloads a new configuration file it could be used to run arbitrary code on the machine. This file would have to be downloaded from a malicious website or received in an email from an attacker. The likelihood a user would download this type of file is low, but not impossible. Gladiator recommends installing the new version of the application on each laptop or home PC needing VPN access. This product only affects users with SonicWALL Firewalls. See below for technical details.

• Continue reading