search menu icon-carat-right cmu-wordmark

CERT/CC Blog

Vulnerability Insights

Latest Posts

Updates to CERT Fuzzing Tools (BFF 2.6 & FOE 2.0.1)

Updates to CERT Fuzzing Tools (BFF 2.6 & FOE 2.0.1)

• CERT/CC Blog
Allen Householder

Hi everybody. Allen Householder from the CERT Vulnerability Analysis team here, back with another installment of "What's new in CERT's fuzzing frameworks?" Today we're announcing the release of updates of both our fuzzing tools, the CERT Basic Fuzzing Framework (BFF) version 2.6 and the CERT Failure Observation Engine (FOE) version 2.0.1. The remainder of this post describes the changes in more detail....

Read More
The Report

The Report "Network Profiling Using Flow" Released

• CERT/CC Blog
Austin Whisnant

Hi, this is Austin Whisnant of the CERT Network Situational Awareness Team (NetSA). After a long time in the making, NetSA has published an SEI technical report on how to inventory assets on a network using network flow data. Knowing what assets are on your network, especially those visible to outsiders, is an important step in gaining network situational awareness....

Read More
Java 7 Attack Vectors, Oh My!

Java 7 Attack Vectors, Oh My!

• CERT/CC Blog
Art Manion

While researching how to successfully mitigate the recent Java 7 vulnerability (VU#636312, CVE-2012-4681), we (and by "we" I mean "Will Dormann") found quite a mess. In the midst of discussion about exploit activity and the out-of-cycle update from Oracle, I'd like to call attention to a couple other important points....

Read More
Java Security Manager Bypass Vulnerability

Java Security Manager Bypass Vulnerability

• CERT/CC Blog
Art Manion

Last Sunday, another major Java vulnerability (VU#636312) was reported. Until an official update is available, we strongly recommend disabling the Java 7 plug-in for web browsers. This vulnerability is bad news, at least for those of us trying to avoid phishing and drive-by browsing attacks. The vulnerability is caused by a logic bug that allows an applet to grant itself full privileges. More technical details are available in Vulnerability Note VU#636312....

Read More
CERT Failure Observation Engine 2.0 Released

CERT Failure Observation Engine 2.0 Released

• CERT/CC Blog
Allen Householder

Hi folks, Allen Householder from the CERT Vulnerability Analysis team here. Back in April, we released version 1.0 of the CERT Failure Observation Engine (FOE), our fuzzing framework for Windows. Today we're announcing the release of FOE version 2.0. (Here's the download.) Although it has only been a few months since we announced FOE 1.0, our development cycle is such that FOE 2.0 actually reflects nearly a year of additional improvements over the 1.0 release....

Read More
Vulnerability Data Archive

Vulnerability Data Archive

• CERT/CC Blog
Art Manion

With the hope that someone finds the data useful, we're publishing an archive of almost all of the non-sensitive vulnerability information in our vulnerability reports database....

Read More
CERT Basic Fuzzing Framework 2.5 Released

CERT Basic Fuzzing Framework 2.5 Released

• CERT/CC Blog
Allen Householder

Hi folks, Allen Householder here. In addition to the recent introduction of our new Failure Observation Engine (FOE) fuzzing framework for Windows and Linux Triage Tools, we have updated the CERT Basic Fuzzing Framework (BFF) to version 2.5. This post highlights the significant changes....

Read More