Oracle's unpatched flaws

NETWORK WORLD NEWSLETTER: JASON MESERVE'S VIRUS AND BUG PATCH
ALERT
07/21/05
Today's focus: Oracle's unpatched flaws

Dear security.world@gmail.com,

In this issue:

* Patches from Apple, FreeBSD, others
* Beware next e-mail greeting card you get
* Microsoft to acquire FrontBridge for e-mail security
* Links related to Virus and Bug Patch Alert
* Featured reader resource
_______________________________________________________________
This newsletter is sponsored by Avocent
Network World Executive Guide: Security Evolves. Automation,
specialized 'ops centers' and more.

For network security professionals, keeping a safe distance
ahead of the worst the bad guys have to offer is a never-ending
race. This guide is designed to help with a collection of news,
analysis and product test reviews for practical how-to advice on
subjects ranging from patch management and spyware to promises
and risks of automated security services.
http://www.fattail.com/redir/redirect.asp?CID=108581
_______________________________________________________________
CAN'T STAND THE HEAT?

Neither can your servers. Having dense servers means more heat
and more power consumption in smaller spaces. Find out why just
adding more air conditioners won't cut it and what you need to
do to stay cool this summer... and beyond. Click here:
http://www.fattail.com/redir/redirect.asp?CID=108464
_______________________________________________________________

Today's focus: Oracle's unpatched flaws

By Jason Meserve

Today's bug patches and security alerts:

Security firm details unpatched Oracle flaws

A German security firm has published details of six security
vulnerabilities in Oracle 's software, three of them high-risk,
that it says were not fixed in an Oracle security update earlier
this month. The decision to publish the vulnerabilities, which
affect Oracle Reports, Oracle Forms, and indirectly some other
Oracle products, raises again the issue of whether security
experts should disclose holes in products before vendors have
patched them. IDG News Service, 07/20/05.
<http://www.networkworld.com/nlvirusbug3579>

Oracle alerts from Red Database Security:
<http://www.networkworld.com/go2/0718bug2b.html>
**********

Microsoft warns of remote access protocol flaw

A flaw in the software used to remotely access computers running
Microsoft's Windows operating system could leave users
vulnerable to a denial-of-service attack, the company said in a
security advisory issued Friday. IDG News Service, 07/18/05.
<http://www.networkworld.com/nlvirusbug3580>

Related Secunia advisory:
<http://secunia.com/advisories/16071/>
**********

Apple patches AirPort 4.2

According to an alert from Apple, "When not connected to a known
or trusted network, the AirPort card "parks" on a randomly
generated network with a default WEP key. This can allow parked
AirPort cards to automatically connect to malicious networks
without warning." For more, go to:
<http://docs.info.apple.com/article.html?artnum=301988>
**********

Buffer overflow in WinAmp

Security researchers have found a buffer overflow in the MP3
meta data information is handled by WinAmp, a popular media
player. An attacker may be able to exploit this to run malicious
code on the affected machine. For more, go to:
<http://www.securiteam.com/windowsntfocus/5KP0H2AGAQ.html>
**********

FreeBSD patches devfs

According to a FreeBSD advisory, "Due to insufficient parameter
checking of the node type during device creation, any user can
expose hidden device nodes on devfs mounted file systems within
their jail. Device nodes will be created in the jail with their
normal default access permissions." For more, go to:
<http://www.networkworld.com/go2/0718bug2a.html>
**********

Today's roundup of virus alerts:

Zombie makers turning to fake greeting cards

The next e-mail greeting card you get may come with a nasty
surprise. According to Internet security vendor SurfControl,
attackers are increasingly using fake e-mail greeting cards as a
way of getting malicious software installed on computers. IDG
News Service, 07/19/05.
<http://www.networkworld.com/nlvirusbug3581>

W32/Mytob-DS -- A new Mytob e-mail variant that allows backdoor
access via IRC. It spreads through a message that starts with
"Here are your banks documents." and drops "taskgmr.exe" on the
infected machine. It prevents access to security related Web
sites by modifying the Windows HOSTS file. (Sophos)

W32/Sdbot-ZO -- This worm spreads through network shares,
dropping "burndl32.exe" on the infected machine and allowing
backdoor access via IRC. (Sophos)

W32/Sdbot-AAZ -- Another Sdbot IRC backdoor. This one installs
itself as "xmconfig.exe" in the Windows System folder. (Sophos)

Troj/Torpig-A -- A keystroke logging Trojan that creates a
"services" directory in the Windows System folder that contains
three files, including "explorer.exe". The keystroke data is
sent by HTTP to a remote site. The virus also has
download/install capabilities. (Sophos)

Troj/BesTof-C -- Interesting, its a Trojan with an uninstall
feature that can be found in the Control Panel Add/Remove
Programs option. It installs itself as "Best Search Engine!!!"
It initially spreads through e-mail with a random message set.
(Sophos)

Troj/Prorat-O -- A Trojan that attempts to download and run
additional malicious code from remote sites. When this virus
first executes it displays a picture called "lncom_.jpg", which
is a close-up of someone's teeth. (Sophos)

Troj/Bancos-DH -- A Trojan that displays fake banking Web sites
as a means of gathering username and password data. It drops
"comdlg32.ocx" in the Windows System directory. (Sophos)
**********

From the interesting reading department:

Microsoft to acquire FrontBridge for e-mail security

Microsoft Wednesday announced its intent to acquire FrontBridge
Technologies, a provider of online service for securing and
archiving e-mail. NetworkWorld.com, 07/20/05.
<http://www.networkworld.com/nlvirusbug3582>

The top 5: Today's most-read stories

1. Future-proof your network
<http://www.networkworld.com/nlvirusbug3583>

2. Appliances replace DNS, DHCP software
<http://www.networkworld.com/nlvirusbug3584>

3. Microsoft sues Google, former employee over hiring
<http://www.networkworld.com/nlvirusbug3585>

4. The ROI of VoIP
<http://www.networkworld.com/nlvirusbug3586>

5. Investors target systems management
<http://www.networkworld.com/nlvirusbug3587>

Today's most forwarded story:

Investors target systems management
<http://www.networkworld.com/nlvirusbug3587>
_______________________________________________________________
To contact: Jason Meserve

Jason Meserve is the Multimedia Editor at Network World and
writes about streaming media, search engines and IP Multicast.
Jason can be reached at <mailto:jmeserve@nww.com>. Check out his
Multimedia Exchange weblog at:
<http://www.networkworld.com/weblogs/multimedia/>

Check out our weekly Network World Radio program at:
<http://www.networkworld.com/radio/>
_______________________________________________________________
This newsletter is sponsored by Avocent
Network World Executive Guide: Security Evolves. Automation,
specialized 'ops centers' and more.

For network security professionals, keeping a safe distance
ahead of the worst the bad guys have to offer is a never-ending
race. This guide is designed to help with a collection of news,
analysis and product test reviews for practical how-to advice on
subjects ranging from patch management and spyware to promises
and risks of automated security services.
http://www.fattail.com/redir/redirect.asp?CID=108580
_______________________________________________________________
ARCHIVE LINKS

Virus and Bug Patch Alert archive:
http://www.networkworld.com/newsletters/bug/index.html

Breaking security news, updated daily
http://www.networkworld.com/topics/security.html
_______________________________________________________________
FEATURED READER RESOURCE
THE NEW DATA CENTER: SPOTLIGHT ON STORAGE

This Network World report takes a look at storage trends such as
virtualization, encryption and archiving. Here you will also
find seven tips for managing storage in the new data center, how
storage encryption can help ease the threat of identity theft,
why one exec believes its all about the information and more.
Click here:
<http://www.networkworld.com/supp/2005/ndc4/>
_______________________________________________________________
May We Send You a Free Print Subscription?
You've got the technology snapshot of your choice delivered
at your fingertips each day. Now, extend your knowledge by
receiving 51 FREE issues to our print publication. Apply
today at http://www.subscribenw.com/nl2

International subscribers click here:
http://nww1.com/go/circ_promo.html
_______________________________________________________________
SUBSCRIPTION SERVICES

To subscribe or unsubscribe to any Network World e-mail
newsletters, go to:
<http://www.nwwsubscribe.com/Changes.aspx>

To change your e-mail address, go to:
<http://www.nwwsubscribe.com/ChangeMail.aspx>

Subscription questions? Contact Customer Service by replying to
this message.

This message was sent to: security.world@gmail.com
Please use this address when modifying your subscription.
_______________________________________________________________

Have editorial comments? Write Jeff Caruso, Newsletter Editor,
at: <mailto:jcaruso@nww.com>

Inquiries to: NL Customer Service, Network World, Inc., 118
Turnpike Road, Southborough, MA 01772

For advertising information, write Kevin Normandeau, V.P. of
Online Development, at: <mailto:sponsorships@nwfusion.com>

Copyright Network World, Inc., 2005