Yesterday, Israeli security researched Danor Cohen reported that Acunetix’s web application security scanner has an exploitable vulnerability. Although the blog post is titled “Pwn the n00bs”, I’ve seen several origanizations use Acunetix to perform scans on (their own?) web applications.
Security bugs appear in all pieces of software; including security scanners and hacking tools. These tools often require to run as root (to perform privileged actions, such as putting a network interface into promiscious mode, etc). LiveUSB security distributions often run all commands as root and could pose a problem. Even though you are running a liveUSB environment, users often mount their HDD or external media to save files. Open source tools can often be fixed easily, but commercial software a la Acunetix usually relies on vendor update channels.
Be careful when running all software, even your security software/hacking tools can be vulnerable.
Leave a Reply