 Virus and Bug Patch AlertThis newsletter is sponsored by EMCNetwork World's Virus and Bug Patch Alert Newsletter, 07/30/07Cisco: Vulnerability in JSSE impacts Call ManagerBy Jason MeserveToday's bug patches and security alerts: Cisco: Vulnerability in Java Secure Socket Extension Some versions of the Sun Java Secure Socket Extension (JSSE) do not handle Transport Layer Security (TLS) or SSL handshakes properly, which could be exploited in a denial-of-service attack. Cisco's Unified Call Manager and Unified Presence systems are affected by the flaw, for which there is no workaround available at this time. Users "are advised to restrict access to the administrative interface to the IP addresses of known management stations."
********** Yahoo patches Widgets, fixes hijack bug on Windows Security researchers today warned that Yahoo Widgets, a platform that runs small, Web-based, gadget-like applications on computer desktops, sports a critical flaw hackers can use to hijack Windows PCs. A bug in an ActiveX control that ships with Yahoo Widgets can be exploited to create a buffer overflow and, after that, introduce rogue code to the compromised computer. The most likely attack scenario, said Yahoo, would find attackers feeding users' links to malicious Web sites. Computerworld, 07/27/07. ********** Attacks likely against unpatched Mac OS Samba bug Symantec this week warned Mac OS X users that the addition of an exploit to the Metasploit hacking framework had boosted the threat posed by an unpatched bug in Samba, the open-source file- and print-sharing software included with the Apple operating system. Although the vulnerability was disclosed May 14 and patched that same day by the Samba community, Apple has not updated Mac OS X with a fix, said Symantec's Alfred Huger, vice president of engineering with the security company's response group. Computerworld, 07/27/07. ********** Trustix releases 'multi' update The latest mega-patch from Trustix fixes flaws in bind, clamav, curl, mod_perl, perl-net-dns, php, and tcpdump. Attackers could exploit the flaws in cache poisoning (Bind), denial-of-service and code execution attacks. ********** Two new patches from rPath: ********** Two new updates from Gentoo: VLC media player (format string, code execution) ********** Today's malware news: Newer variants of the widespread Storm worm have introduced a new technique for evading security experts -- detecting when they are running in a virtual environment and changing their behavior if they are. TechWorld, 07/26/07. Related: Fun & Games: We're seeing a substantial seeding of a new Storm Worm variant. F-Secure: Another Messenger worm spreading There's a MSN Messenger worm spreading. It sends messages to other Messenger contacts that are along the lines of: One of our team members received an unsolicited but interesting e-mail recently confirming his new account at a certain Web site, and containing the login username and password. The e-mail was addressed to him personally using his full name so undoubtedly his details were mined from somewhere on the Internet. Symantec Security Response Weblog, 07/27/07. ********** From the interesting reading department: IM attacks up nearly 80%, Akonix says Malicious code attacks over instant messaging networks are up almost 80% over last year, according to a new study from vendor Akonix. In July, the company, which develops IM hygiene and compliance appliances and services, said it uncovered 20 malicious code attacks over IM in July. The total number of threats for 2007 so far is 226, the company said. That number is a 78% increase over the last year. Network World, 07/27/07. Database admin at Fidelity National stole more data than thought A senior database administrator at a subsidiary of Fidelity National Information Services who was responsible for defining and enforcing data access rights at the firm took data belonging to as many as 8.5 million consumers -- not 2.3 million, as originally disclosed by the company. With Black Hat approaching, a rush to patch iPhone With security researchers set to reveal details of a critical security flaw in the iPhone at the Black Hat 2007 conference next week, Apple now has fewer than seven days to patch a critical vulnerability in the product. IDG News Service, 07/26/07. Why we're losing the botnet battle Botnets -- they're dangerous, deceptive, and very difficult to detect and deal with. What's more, according to recent surveys, the botnet threat is growing...rapidly. Experts say it's imperative that enterprises become aware of the acute and growing dangers posed by botnets, and take decisive and effective steps to counter them before it's too late. CIO, 07/25/07. IT execs divided on need for strategic security vendor When it comes to picking a single "strategic security vendor," IT executives are decidedly at odds. Questioned whether they had such a vendor, 50 executives rendered a split decision, with 42.6% indicating they do and 57.4% saying they don’t, according to a report from Nemertes Research. Network World, 07/26/07. The Advent of the Computer Hacker Scene The hacking scene is definitely not what it used to be. Though it seems hard to remember, there was a time before vulnerabilities were posted to mailing lists every day, you could sell exploits to corporations and hacking groups were being turned into security companies. Symantec Security Response Weblog, 07/27/07. Q&A: Security top concern for new IETF chair Three months into his job as chair of the leading Internet standards body, Russ Housley talked with Network World National Correspondent Carolyn Duffy Marsan about his strategy for bolting security onto the freewheeling Internet. Network World, 07/26/07. Slamming the company door on porn Your organization's next e-mail filtering software may come equipped with a blocking component that prevents pornographic content from entering the corporate network. CIO, 07/25/07. How cheaters are winning at online games like World of Warcraft The new book "Exploiting Online Games" by Greg Hoglund and Gary McGraw explains how cheaters are winning at online role-playing games such as World of Warcraft where millions of players compete in the virtual world to win battles or treasure that is sometimes later sold to avid game players for real money. Network World, 07/27/07. Editor's Note: Starting Aug. 13, this newsletter will be renamed "Security: Threat Alert" to better reflect the focus of the newsletter. We thank you for reading Network World newsletters!
|
| Contact the author: Jason Meserve is Network World's Multimedia Editor and writes about streaming media, search engines and IP Multicast. Check out his Multimedia Exchange Weblog. Check out Jason Meserve and Keith Shaw's weekly podcast "Twisted Pair" This newsletter is sponsored by EMCARCHIVEArchive of the Virus and Bug Patch Alert Newsletter. BONUS FEATUREIT PRODUCT RESEARCH AT YOUR FINGERTIPS Get detailed information on thousands of products, conduct side-by-side comparisons and read product test and review results with Network World’s IT Buyer’s Guides. Find the best solution faster than ever with over 100 distinct categories across the security, storage, management, wireless, infrastructure and convergence markets. Click here for details. PRINT SUBSCRIPTIONS AVAILABLE International subscribers, click here. SUBSCRIPTION SERVICESTo subscribe or unsubscribe to any Network World newsletter, change your e-mail address or contact us, click here. This message was sent to: security.world@gmail.com. Please use this address when modifying your subscription. Advertising information: Write to Associate Publisher Online Susan Cardoza Network World, Inc., 118 Turnpike Road, Southborough, MA 01772 Copyright Network World, Inc., 2007 |
No comments:
Post a Comment