Security Advisories

Within the scope of our activities we often happen to find vulnerabilities which have not been known yet. We contact the manufacturers to inform them about these vulnerabilities in order to allow them to implement a patch or a fix. The cooperation with the manufacturers varies, but is usually good. We have already dealt with the following manufacturers:

Microsoft
SAP
Nortel
Finjan
Linux community
OpenCMS
Various small software manufacturers

Vulnerability Disclosure Policy

Date	Subject	Link
CVE-2009-1479	Camtasia Flash Vulnerability
CVE-2009-1479	Boxalino Directory Traversal Vulnerability
CVE-2009-1048	Authentication Bypass of Snom Phone Web Interface
2009	Response Header Name Injection Attack
CVE-2008-3358	SAP NetWeaver XSS Vulnerability
CVE-2008-1547	MS OWA URL Redirection Vulnerability
CVE-2008-0385	Urulu Web 2.0 SQL Injection
2008	OKI C5510MFP Printer Password Disclosure
CVE-2007-6340	LSrunasE, Supercrypt Weak Crypto
2007	VoIP Phone Audio Stream Rerouting Vulnerability
2007	Nortel_IP_phone_flooding_denial_of_service
2007	Nortel_IP_phone_forced_re-authentication
2007	Nortel_IP_phone_surveillance_mode
2007	Nortel_telephony_server_denial_of_service
2007	Nortel_UNIStim_IP_softphone_buffer-overflow
2007	DokuWiki XSS Vulnerability
2007	SAP Internet Communication Framework (BC-MID-ICF)
2007	SAP NetWeaver, Web Dynpro Java (BC-WD-JAV)
CVE-2007-4018	Citrix - Redirection Vulnerability
CVE-2007-0011	Citrix - Session Hijacking and Information Disclosure
2007	Linux Kernel Buffer Overflow
2006	Internet Explorer MS06-13 Vulnerability
2004	OpenCMS Session Fixation
2003	Finjan Content Bypass Vulnerability

News

Compass' Testing Modules
1/27/10 - Compass Security has created the document "Testing Module" describing the typical testing scenarios

Workshop on Mobile Security at MCTA 2010
1/11/10 - Marco Di Filippo, Regional Director Germany of the ICT security service provider Compass Security AG (www.csnc.ch) informs in a workshop about the risks of mobile communication tools. This will be held on 01 February at the 10th Conference "Mobile Communications Technologies and Applications" (MCTA) at the University of Augsburg.

Loophole detected in "Camtasia Studio"
11/30/09 - Michael Schmidt, Security Analyst at Compass, has analysed a flash application which has been created with the software "Camtasia Studio" by TechSmith.

Compass Event 2009
10/27/09 - On 15 October 2009, the "Compass Event" took place in the auditorium of the HSR University of Applied Sciences in Rapperswil/Switzerland.

Cyber terrorism: German infrastructure highly vulnerable
9/28/09 - Compass Security shows how easy it is to compromise power, internet and telecommunication networks in Germany.