There have been various recent(-ish) vulnerabilities found in the BOINC software for desktop grid computing. The major projects have (hopefully) fixed all of these by now, and the clients should only be vulnerable if they're connected to a hostile server. The commit ids below are all from the boinc-v2 repository, see http://boinc.berkeley.edu/trac/browser/boinc-v2 for a web view. These are the ones I consider to be obviously important: * CVE-2013-2298: various stack overflow vulnerabilities in the XML parser used by both the client and server software. I think that any 7.x version is vulnerable, but possibly not the 6.12 branch or earlier. No promises. (Found/reported by me. I notified all public projects I could find who were running obviously-vulnerable copies of the code, in early March.) http://thread.gmane.org/gmane.comp.distributed.boinc.user/3741 2fea03824925cbcb976f4191f4d8321e41a4d95b * Stack overflow in the client code by providing multiple file_signature elements. 6.10.58 and 6.12.34 are vulnerable. 7.x isn't. (This was fixed back in 2011, possibly accidentally.) 9a4140ae30a72e5175f3f31646d91f2d58df7156 * SQL injections in the server-side scheduler code: (Found/reported by me. I warned projects about this at the same time as the the above notifications, hopefully they've mostly patched it..) http://thread.gmane.org/gmane.comp.distributed.boinc.user/3776 3ced18ddaaea5e03d2cc70f8cce5ab214b4d5635 * SQL injections in the user-facing web scripts: (These were possibly found by Michael Vo, see http://www.mdr.de/mdr-info/hacker-boinc100.html ) http://thread.gmane.org/gmane.comp.distributed.boinc.user/3658 e8d6c33fe158129a5616e18eb84a7a9d44aca15f 6e205de096da83b12ffb2f0183b43e51261eb0c4 ce3110489bc139b8218252ba1cb0862d69f72ae3 And some issues I'm not sure are quite so important: * Stack overflows in the trickle code on server and client side: (Fixed back in 2011, and these were only present in experimental 6.13.x releases, as far as I know.) 5b04b249db166ec38c1ee99a9eadcaa300c0f454 ae04b50a71f3e96ee1bc59b76fca97cf0fe976f7 * From a few days ago, a possible format string issue(?) in the client code: (Noticed by Gianfranco Costamagna/Nicols Alvarez judging by the thread) http://thread.gmane.org/gmane.comp.distributed.boinc.devel/6416 99258dcecba8ef36e1ce0fd6e0dacffe53613ac9 * An SQL injection vulnerability in the locality code (apparently only used by one known project), so I mention this just for completeness just in case anyone happens to be using it: 2dbfdc55057b2c1f0508b56244044b1ad34e7cdb - Alyssa