Security Advisories

Within the scope of our activities we often happen to find vulnerabilities which have not been known yet. We contact the manufacturers to inform them about these vulnerabilities in order to allow them to implement a patch or a fix. The cooperation with the manufacturers varies, but is usually good. We have already dealt with the following manufacturers:

Microsoft
SAP
Nortel
Finjan
Linux community
OpenCMS
Various small software manufacturers

Vulnerability Disclosure Policy

Date	Subject	Link
CVE-2009-1479	Camtasia Flash Vulnerability
CVE-2009-1479	Boxalino Directory Traversal Vulnerability
CVE-2009-1048	Authentication Bypass of Snom Phone Web Interface
2009	Response Header Name Injection Attack
CVE-2008-3358	SAP NetWeaver XSS Vulnerability
CVE-2008-1547	MS OWA URL Redirection Vulnerability
CVE-2008-0385	Urulu Web 2.0 SQL Injection
2008	OKI C5510MFP Printer Password Disclosure
CVE-2007-6340	LSrunasE, Supercrypt Weak Crypto
2007	VoIP Phone Audio Stream Rerouting Vulnerability
2007	Nortel_IP_phone_flooding_denial_of_service
2007	Nortel_IP_phone_forced_re-authentication
2007	Nortel_IP_phone_surveillance_mode
2007	Nortel_telephony_server_denial_of_service
2007	Nortel_UNIStim_IP_softphone_buffer-overflow
2007	DokuWiki XSS Vulnerability
2007	SAP Internet Communication Framework (BC-MID-ICF)
2007	SAP NetWeaver, Web Dynpro Java (BC-WD-JAV)
CVE-2007-4018	Citrix - Redirection Vulnerability
CVE-2007-0011	Citrix - Session Hijacking and Information Disclosure
2007	Linux Kernel Buffer Overflow
2006	Internet Explorer MS06-13 Vulnerability
2004	OpenCMS Session Fixation
2003	Finjan Content Bypass Vulnerability

News

Evening event of ISSS on "Cyber Crime in Switzerland"
2/23/10 - Ivan Bütler, Compass managing director, is organizing the "1st ISSS St Gall conference" together with Dr. Lukas Ruf. On Thursday, April 29, 2010, interested people are meeting in order to gain an up-to-date overview in the field of computer crime an to become familiar with the developments.

Compass hacks live at CeBIT
2/22/10 - Marco Di Filippo, Regional Director Germany of Compass Security AG takes on the role of the hacker at CeBIT and puts modern technologies to the test. On the CeBIT platforms of the media partner Network Computing and of the anti virus specialist Avira he is going to x-ray data centers and mobile devices such as iPhone, Blackberry, etc. regarding their safety compliance.

Presentation to the Compass-Workshop on "Mobile Security" at MCTA 2010
2/10/10 - On the 10th Conference "Mobile Communications Technologies and Applications (MCTA 2010), Marco Di Filippo, Compass Regional Director Germany, hold a workshop titled "Mobile Security – Attacking scenarios on mobile services" .

Compass' Testing Modules
1/27/10 - Compass Security has created the document "Testing Module" describing the typical testing scenarios

Workshop on Mobile Security at MCTA 2010
1/11/10 - Marco Di Filippo, Regional Director Germany of the ICT security service provider Compass Security AG (www.csnc.ch) informs in a workshop about the risks of mobile communication tools. This will be held on 01 February at the 10th Conference "Mobile Communications Technologies and Applications" (MCTA) at the University of Augsburg.