Security World

6 hot security startups to watch in 2012

2012-01-27T11:49:00.000-08:00

Facebook IPO filing seen coming as early as next week | Security roundup: The triumph of hactivists, the sorrow of Symantec

Network World Daily News PM

Forward this to a Friend >>>

6 security companies to watch
This group of security companies includes several that want to capitalize on technology ideas that were originally devised to serve communities of special interest but could now take on a wider cybersecurity role. Fixmo, for example, has its roots in the National Security Agency where its mobile security makes it possible to run critical applications in sandboxes that are insulated from the rest of the machine, making them less likely to fall victim to malware that might have infected the device. Read More

RESOURCE COMPLIMENTS OF: CloudPassage

CloudPassage
CloudPassage Halo is the award winning cloud server security platform that has everything you need to secure your cloud servers - from dynamic firewalls to intrusion detection, and account management. Halo is SaaS and installs in 5 minutes. Halo Basic is free for up to 25 servers. Try Halo

In this Issue

WEBCAST: Radware

Control the Cloud Like You Do Your Own Infrastructure
Industry analyst Robin Layland joins Alan Murphy from F5 Networks and Greg Smith from Citrix to explore how an ADC can allow you to control your applications running in the cloud as effectively as you control them when they are running in your data center. Learn More

Facebook IPO filing seen coming as early as next week
Suspended trading adds to speculation that long-anticipated public offering is near Read More

Security roundup: The triumph of hactivists, the sorrow of Symantec
It was another busy week for hactivists attacking the online targets of their ire. This time, hackers under the banner AntiSec appeared to have hacked the website of OnGuardOnline.gov, the U.S. government's online security website, in protest against the much-railed-against legislation Stop Online Piracy Act (SOPA) as well as other bills regarding intellectual protection. Similarly, the group Anonymous is believed to be behind the distributed denial-of-service attack on Thursday that brought down the European Parliament's website in what is thought to be retaliation for European support for the shutdown of the Megaupload file-sharing site the week before. Anonymous also opposes a treaty being ratified in Europe now called the Anti-Counterfeiting Trade Agreement. That deals with infringement of intellectual property rights. Read More

Happy birthday, iPad! RIP, pretenders
Two years ago today, Steve Jobs unveiled the iPad. Computing has never been the same, despite all the 'iPad killers' Read More

WHITE PAPER: VCE/VMware

Centralized Virtual Desktop Eases PC Procurement
As CVD technology matures, it will become increasingly applicable to greater parts of organizations and a greater breadth of industry verticals beyond the typical healthcare, finance, government, and education verticals that dominate the CVD market today. Learn More

Dying Jobs kept letter from Gates at his bedside
Shortly before Steve Jobs died in October, he received a letter from longtime business adversary Bill Gates that moved him so much that he kept it by his bedside, according to the Apple founder's widow, as relayed by Gates to a British interviewer. Read More

The real reasons why SOPA and PIPA are real bad
A reader letter makes Gibbs sum up why SOPA and PIPA are such bad ideas. Read More

MacIT: IT groups grapple with managing fast-growing iOS devices
Apple recently has improved its mobile device management features, but IT groups are discovering a new set of challenges when they start to move to larger numbers of iOS devices, MacIT conference attendees are confirming this week. Read More

WHITE PAPER: Internap

New eBook: A Colocation Buyer's Guide
Whether you're determining if colocation is the right fit for your business or you are currently in the process of selecting a colocation provider, you'll find this eBook an essential must read for making the right decision for your business. Learn More

Hacking stunt: Stealing smartphone crypto keys using plain old radio
Encryption keys on smartphones can be stolen via a technique using radio waves, says one of the world's foremost crypto experts, Paul Kocher, whose firm Cryptography Research will demonstrate the hacking stunt with several types of smartphones at the upcoming RSA Conference in San Francisco next month. Read More

CloudPassage launches new security product for public clouds
CloudPassage is launching a new security product for virtual servers in public clouds such as Amazon Web Services that it says takes care of the all-important need for security when using services from infrastructure providers. Read More

How to Prevent Thumb Drive Security Disasters
Small USB flash drives can cause big security headaches. Learn how four very different organizations have managed to balance the need to allow employees to transfer files for legitimate business purposes with the need to prevent data leaks. Read More

Linux Mint 13 gets back to desktop basics
Bucking the trend of increasingly experimental desktop interfaces, the developers behind the Linux Mint are adopting a simpler desktop for the next version of the open-source Linux distribution. Read More

New leaders emerging in WAN optimization market
In yet another sign that growing revenues are reshaping the vendor outlook in the network management sector, Gartner recently named vendor Silver Peak one of the leaders in its magic quadrant for the WAN optimization market. Read More

SLIDESHOWS

2012's 25 Geekiest 25th Anniversaries
Network World's 6th annual collection of the year's "geekiest anniversaries" this time includes the births of pioneering companies such as UUNet and NEXTEL; technologies like OS/2 and SPARC; television classics topped by "Star Trek: The Next Generation" and the first "Simpsons" shorts; disposable contact lenses; the first naked-eye supernova in four centuries; and, who could possibly forget The Woodstock of Physics?

CISCO SUBNET
Looking for a place where everyone understands your joy and pain with Cisco routers, switches and other gear? Check out our Cisco Subnet, a community of Cisco experts blogging on the latest network topics. Enter here.

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_daily_news_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

Security Management Weekly - January 27, 2012

2012-01-27T10:52:00.000-08:00

Learn more! ->

January 27, 2012

Corporate Security
Sponsored By:

"Security Contractors See Opportunities, and Limits, in Mexico"
"Adding Weapons to ATM Defenses"
"Con Artist Starred in Sting That Cost Google Millions"
"Cameras May Open Up the Board Room to Hackers"
"Energy Companies Under Siege" Vandalism and Theft at Wind Towers

Homeland Security

"Guarding the Nation's Money" Bureau of Engraving and Printing Security Chief Will Levy III
"Nigeria Pursues Talks With Militant Group"
"Australia's Gillard Rescued by Police"
"Obama Orders Strategy for Protecting Nation's Supply Chain"
"Former CIA Officer Charged in Leaks Case"

Cyber Security

"Symantec Advises Customers on Breach"
"Attackers Using DNS Poisoning to Hijack Website Domains, Divert Traffic" Domain Name System
"Linux Vendors Rush to Patch Privilege Escalation Flaw After Root Exploits Emerge"
"Security Best Practices Reduce Downtime From Cyber-Attacks: Survey"
"Ex-U.S. Spy Chief Says May Take Crisis for New Cyber Law"

Security Contractors See Opportunities, and Limits, in Mexico
Washington Post (01/27/12) Miroff, Nick; Booth, William

Rising rates of violence have made Mexico a growing market for security contractors in the U.S. Among the American security contractors that are offering their services south of the border is Kroll, whose anti-kidnapping specialists work to protect Mexican business executives. Meanwhile, the California-based company SECFOR is providing personal security services to business executives in a number of industrial Mexican cities, most of which are along the country's border with the U.S. Such firms are being lured into the Mexican market by growing demand for personal protection services. Robert Munks, a senior Americas analyst at IHS-Jane's, said demand for personal protection services in Mexico is rising by at least 20 percent annually. Munks noted that demand is growing because foreign and local business executives want to protect their families and their employees. In addition, private security companies are attracted to the billions of dollars in funds that the U.S. government has made available to them to provide services in Mexico, as well as the growing rate of spending on security by private Mexican companies and the Mexican government. However, some U.S. security companies may be hesitant to move into the Mexican market because Mexican law forbids foreigners from carrying guns in the country. Although U.S. security contractors can partner with Mexican companies whose employees are allowed to carry guns, experts say that American companies should be careful who they work with because many people who work in private security are believed to also have ties to organized crime networks.

Web Link | Return to Headlines

Adding Weapons to ATM Defenses
Wall Street Journal (01/26/12) Kapner, Suzanne

ATMs have become big targets for thieves. According to the FBI, more money is stolen by thieves who compromise ATM systems and perpetrate other types of data breaches than by thieves who rob bank branches. Robbing an ATM can be lucrative, as a typical ATM heist nets thieves 10 times as much cash as a bank robbery, the American Bankers Association says. Faced with these threats, ATM manufacturers are taking steps to improve the security of their machines. Diebold, for instance, is developing an ATM that uses cloud computing to store information in a remote location instead of in the ATM itself. Diebold says that the use of cloud computing would make ATM software easier to protect, as it would be stored in a centralized location. However, some security experts believe that putting large amounts of data in the cloud will make cloud computing systems a target for hackers. Meanwhile, the Brazilian company Itautec is wrapping up development on a prototype ATM that uses holographs that consumers use to make transactions with hand gestures. Consumers will not be able to touch the ATM itself, except for the part that dispenses cash, as most of the machine will be protected by bulletproof glass. Other ideas that are in the works at other companies are ATMs that require consumers to tap their phones instead of swiping their cards in order to make transactions. Such technology is designed to cut down on skimming. Despite the security threats to ATMs, it is unclear whether banks will invest in these technologies, given the fact that many financial institutions are under a great deal of pressure to reduce their costs.

Web Link | Return to Headlines

Con Artist Starred in Sting That Cost Google Millions
Wall Street Journal (01/25/12) Catan, Thomas

New information has come to light about a 2009 sting operation that focused on the aid Google provided for illegal online prescription drug sales. The sting began after federal prosecutors set up a task force to look into allegations by David Whitaker that he was able to start an online pharmacy and sell steroids and human growth hormone (HGH) to consumers in the U.S. via Google ads. Whitaker posed as an agent for advertisers and worked with federal agents to try to set up a Web site that was designed to look as if it had been set up by a Mexican drug lord to sell HGH and steroids. Although Google initially rejected that site as well as another one that was designed to sell drugs over the Internet, the company's ad executives allegedly helped Whitaker bypass Google's rules so that the sites could be set up. Federal agents also created several other sites, including one that was based outside the U.S. and sold the abortion pill RU-486, which can in the U.S. can only be administered to patients in doctor's offices. Google approved the creation of that site and made it so that consumers in the U.S. who searched for RU-486 would see an ad for the site. Google also allowed the ad for the site to say that the drug was available without a prescription. Agents later added links to the site that allowed consumers to purchase the drugs directly, which violated U.S. laws that forbid the sale of drugs from outside the country and without a prescription. Records in the case indicate that Google executives may have known about the legal problems with the ads. Google eventually settled the case for $500 million and said that it had improperly and knowingly helped online pharmacy advertisers run ads for illegal pharmaceutical sales.

Web Link | Return to Headlines

Cameras May Open Up the Board Room to Hackers
New York Times (01/23/12) Perlroth, Nicole

Advanced digital videoconferencing equipment has vastly improved meeting opportunities for coworkers and clients across the globe, but the new systems can also be hacked to spy on those meetings, potentially jeopardizing confidential client data or corporate secrets. In a recent demonstration, HD Moore, a chief security officer at Boston-based IT security company Rapid7, showed that he could remotely manipulate videoconferencing equipment to hear or see anything in a board room. “These are literally some of the world's most important boardrooms — this is where their most critical meetings take place — and there could be silent attendees in all of them,” warned Mike Tuchen, chief executive of Rapid7. According to Tuchen, these vulnerabilities are caused by IT administrators setting up videoconferencing links outside of company firewalls and configuring them in ways that create easy targets for hackers. No company has yet announced that they have been compromised using videoconferencing, but it is also entirely possible that companies have been victimized and may not be aware. Some new systems are outfitted with a feature that does not require users to accept every person that dials into their conference. These features can help a meeting run more smoothly, but could also make uninvited guests much harder to detect. Moore recently wrote a computer program that would allow him to detect any videoconferencing links located outside their company firewalls and configured to automatically answer calls. In less than two hours, he scanned about 3 percent of the Internet, discovering 5,000 open conference links at law firms, pharmaceutical companies, oil refineries, universities and medical centers. In order to prevent hackers from being able to do the same, Rapid7 recommends companies set up a "gatekeeper" that securely connects calls from outside the company firewall.

Web Link | Return to Headlines

Energy Companies Under Siege
Security Products (01/12) Vol. 16, No. 1, P. 22 Hernandez, Juan

To most people, wind towers represent natural energy and a future free from oil dependence, but for some unscrupulous individuals, the towers represent targets of opportunity and treasure -- to be vandalized and pillaged. Brent Schiebel, an industry-leading wind equipment integrator and owner of WindTesting.com, has witnessed his share of "green" theft over the years. "I could not believe how quickly the equipment, solar panels, and meteorological towers were disappearing," Schiebel said. "Since wind development has skyrocketed in the Mojave area, crime has grown right along with it." Solar panels are lucrative targets. According to The New York Times, the sale of stolen panels is the largest growing black market in the United States. Schiebel knew his company had to do something quickly, so he began looking into industrial security companies and came across Brian Levy from Hero Security and Surveillance Inc. Brian Levy could see the challenges on his plate. "Protecting 30 square miles of desert is extremely difficult," Levy said. "My client needed a surveillance solution that could stand alone, be easy to use, and cover as much of the vulnerable area as possible." Levy drew upon his years of experience with surveillance equipment, networking, and fabrication to set up a standalone surveillance system that came to life when anyone breached its motion detection boundary. The Electronic Surveillance Protector (ESP) Levy and his team set up for Schiebel is a 12-foot-tall sentinel that uses advanced IR to spot human or vehicular presence. "I knew false alarms were not going to be tolerated, so I focused on detectors with unique processing ability," Levy explained. "The whole package had to be reliable. I chose ICRealtime for their track record of offering advanced products that delivery great results."

Web Link | Return to Headlines

Guarding the Nation's Money
Washington Post (01/24/12)

Will Levy III has helped change the culture of security at the U.S. Bureau of Engraving and Printing (BEP) since coming onboard as the agency's chief of security four years ago. During his tenure, Levy--who is responsible for managing a team of almost 200 employees charged with protecting currency production facilities in Washington, D.C., and Fort Worth, Texas, and with ensuring the safety of agency employees and visitors to the two BEP facilities--has rewritten all of BEP's security policies and plans and has built an emergency operations center. In addition, Levy has taken steps to reduce the amount of time it takes to perform background checks on job candidates and has made various areas of the security work at BEP more efficient. Levy noted that all of this was done after developing a clear vision of where BEP needed to be and by creating and communicating a roadmap and timeline that would be used to help achieve that vision. In addition to improving security at BEP, Levy has also helped improve working conditions and morale among employees at the agency by getting feedback from workers on changes that should be made. His efforts helped move BEP from No. 219 on the list of best places to work in the federal government in 2010, which is near the bottom, to No. 174 in the 2011 rankings.

Web Link | Return to Headlines

Nigeria Pursues Talks With Militant Group
Wall Street Journal (01/27/12) Hinshaw, Drew

Nigerian president Goodluck Jonathan has reportedly sent envoys to negotiate with representatives of the militant Islamic group Boko Haram. The group is based in northern Nigeria, an area that is mostly poor and primarily Muslim. Sources say the Nigerian government has chosen to negotiate with Boko Haram leaders that are considered to be less hostile and more pragmatic. Many believe that Boko Haram members have legitimate concerns regarding economic inequality throughout the country. Boko Haram has claimed responsibility for a series of attacks on the government, police, and Nigeria's Christian population, but Jonathan is hopeful that these talks could bring an end to the violence.

Web Link | Return to Headlines

Australia's Gillard Rescued by Police
Wall Street Journal (01/26/12) Curran, Enda

Australian Prime Minister Julia Gillard had to be evacuated from a restaurant in Canberra, Australia, on Thursday when it was surrounded by 50 to 100 protesters carrying rocks and sticks. Gillard was at the restaurant for a function to honor emergency service workers on the country's national holiday, Australia Day. About 50 police were dispatched to the scene and helped escort the prime minister safely to her vehicle. No one was injured in the incident and no arrests were made. Police said the protesters had not planned the incident and had likely broken off from a nearby event commemorating the Aboriginal Tent Embassy. Hundreds of people attended the event to honor the landmark and call for greater rights and sovereignty for indigenous people on Australia Day, which they called "invasion day." The protest followed controversial remarks from opposition leader Tony Abbott, who was attending the emergency services event at the restaurant, calling the Tent Embassy irrelevant.

Web Link | Return to Headlines

Obama Orders Strategy for Protecting Nation's Supply Chain
Bloomberg (01/25/12) Runningen, Roger

President Obama has released his National Strategy for Global Supply Chain Security, which orders the Department of State and the Department of Homeland Security (DHS) to develop recommendations within six months that show how to identify and mitigate risks to the U.S. supply chain on an international scale. Potential threats to be targeted by the recommendations include both natural disasters and criminal or terrorist attacks, the president said in a letter. Although the letter makes no recommendation about cybersecurity it does reference the International Strategy for Cyberspace released by the White House in May 2011. There has been some concern that hackers could disrupt the supply chain via computer networks used by banks, telecommunications companies, railroads, and airlines.

Web Link | Return to Headlines

Former CIA Officer Charged in Leaks Case
Washington Post (01/24/12) Miller, Greg

A former CIA officer who worked for the agency for 14 years has been charged with revealing the identity of an undercover officer and providing classified information to unauthorized individuals. According to federal prosecutors, John Kiriakou served as a source for a variety of news organizations whose reporters were writing stories in 2008 and 2009 about CIA operations following the Sept. 11 attacks. Among the stories that Kiriakou is accused of being a source for is a 2008 New York Times piece in which the name of the CIA's interrogator of Sept. 11 mastermind Khalid Sheik Mohammed was revealed. In addition, Kiriakou is believed to have supplied information to reporters that contributed to a security breach at the Guantanamo Bay detention facility that allowed defense attorneys to obtain pictures of CIA operatives who were thought to have been involved in the interrogations of terrorist suspects. Those interrogations involved the use of controversial techniques that some have described as being torture. The pictures were later found in the cells of some high-value terrorist suspects. Kiriakou has also been charged with lying to the CIA about where other sensitive material that he published in a book came from. He faces as much as 30 years in prison if he is convicted on the charges against him.

Web Link | Return to Headlines

Symantec Advises Customers on Breach
Wall Street Journal (01/26/12) Jones, Steven D.

Symantec customers who use the company's pcAnywhere software are being urged to update or disable the application to protect themselves from any possible security threats that may arise from the release of stolen source code earlier this month. A group posted the source code on the Internet on Jan. 5, saying that it exposed weaknesses in Symantec's Norton Antivirus program. Although the code was stolen six years ago, Symantec said that its exposure still represented a potential threat to pcAnywhere. To help protect its customers, Symantec has released updates to version 12.5 of pcAnywhere. No suspicious activity or network security breaches have been reported by pcAnywhere users so far. However, Symantec is monitoring its global networks for unusual activity connected with the theft of the code. No other security products, including Norton Antivirus, have been affected by the breach.

Web Link | Return to Headlines

Attackers Using DNS Poisoning to Hijack Website Domains, Divert Traffic
eWeek (01/25/12) Rashid, Fahmida Y.

Several Web sites have been recently targeted by activist hackers carrying out DNS poisoning attacks, in which traffic to the targeted site is redirected to a malicious site. The hacker group UGNazi said that it carried out the attacks because the organizations had lent their support to the Stop Online Piracy Act. Internet Identity CEO Lars Harvey says the UGNazi hackers carried out the attack by accessing domain management accounts at the registrar where the organizations had registered their domains. Harvey theorizes that the hackers were likely able to access these accounts by exploiting weak or compromised user passwords or a security flaw in the registrar's Web site. Problems caused by both of these attacks, as well as a recent DNS poisoning attack on CBS.com, were detected and corrected within a matter of hours. Although the hackers that have carried out the recent DNS poisoning attacks appear to be inexperienced, organizations should still take steps to protect themselves, Harvey says. For instance, they should be sure to register their domains with registrars that primarily work with companies, since they are more likely than consumer-oriented registrars to have security measures in place to detect DNS poisoning attacks. In addition, organizations should continuously monitor the DNS in order to detect attacks as they occur.

Web Link | Return to Headlines

Linux Vendors Rush to Patch Privilege Escalation Flaw After Root Exploits Emerge
IDG News Service (01/24/12) Constantin, Lucian

Linux vendors are working to apply patches to a privilege escalation vulnerability that exists in the Linux kernel. The security flaw, which is known as CVE-2012-0056, is caused by the inability of the Linux kernel to properly restrict access to a particular file. Attackers can take advantage of this vulnerability to gain root access to systems running Linux versions 2.6.39 and higher. Although patches have been released to correct CVE-2012-0056, proof-of-concept exploit code was released online before Linux vendors had the chance to apply the fixes. Among the exploits that have been released is one called mempodipper, which bypasses some of the factors that could mitigate the impact of CVE-2012-0056 in Linux distributions such as Fedora and Gentoo. Another exploit called mempodroid uses mempodipper as the basis for a local root exploit for Android 4.0, which is also known as Ice Cream Sandwich. Although there are only two devices that currently run Android 4.0, mempodroid could make it possible to root devices that eventually get upgraded to Ice Cream Sandwich.

Web Link | Return to Headlines

Security Best Practices Reduce Downtime From Cyber-Attacks: Survey
eWeek (01/24/12) Rashid, Fahmida Y.

Although there is no security panacea to prevent all attacks, Symantec's most recent survey found that following best practices is a smarter defense than cutting protection corners. Organizations that invested in tighter defenses and trained employees to be more self-aware were in a stronger position to thwart or withstand attacks, Symantec found. The survey's top-tier organizations were 2.5 times less likely to encounter a major cyberattack, and 3.5 times less likely to experience downtime compared to other organizations, according to Symantec's Jason Nadeau. Researchers wrote in their report that antivirus software is no longer effective by itself, and that the organizations that had used more sophisticated security technologies and practices were more ready and better able to circumvent attacks. Organizations with higher scores reported using various layers to guard their assets, including data loss prevention, intrusion prevention and detection systems, anti-malware, and firewalls. Almost all of the organizations in this group reported carrying out awareness training for employees. The policies and practices of respondents in the top tier contrasted sharply to those who ranked in the bottom tier, Symantec researchers wrote. The bottom-tier organizations did not frequently educate employees on security best practices and were more likely to experience steep losses following a successful cyberattack, the report found.

Web Link | Return to Headlines

Ex-U.S. Spy Chief Says May Take Crisis for New Cyber Law
Reuters (01/23/12) Zakaria, Tabassum

Former U.S. Director of National Intelligence and National Security Agency Director Mike McConnell said it will likely take a crisis along the lines of a banking system implosion or a major electric power outage to spur constructive legislative action on protecting cyber infrastructure. Separate pieces of cyber security improvement legislation are on the books in the Senate and the House of Representatives, with Senate Majority Leader Harry Reid (D-NV) promising that the Senate will consider comprehensive cyber security legislation this year. Meanwhile, the House Intelligence Committee in December passed a bill that would give U.S. spy agencies license to share cyber threat intelligence with private companies, a proposal that has provoked fears of federal surveillance of private information. McConnell noted that the government can assume unique responsibilities, such as code breaking, which are outside the purview of the private sector. A 2011 U.S. intelligence report singled out China and Russia for stealing U.S. trade and technology secrets by practicing cyber espionage. McConnell pointed out that if the NSA detected a cyber threat against the U.S. private sector, it has no authority to do anything apart from issuing a report. He noted that the United States has a cyber attack capability and has used it effectively. McConnell stressed as a priority the need to shield critical infrastructure from cyber attack, and intellectual property from theft via cyber espionage.

Web Link | Return to Headlines

ASIS also offers a daily and a non-sponsored, special-content Professional Edition of
Security Newsbriefs. Please click to see a sample or to contact us for more information.

Unsubscribe | Change E-mail | Advertising Opportunities | Security Management Online | ASIS Online

[SECURITY] [DSA 2396-1] qemu-kvm security update

2012-01-27T10:37:00.000-08:00

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2396-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
January 27, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : qemu-kvm
Vulnerability : buffer underflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2012-0029

Nicolae Mogoraenu discovered a heap overflow in the emulated e1000e
network interface card of KVM, a solution for full virtualization on
x86 hardware, which could result in denial of service or privilege
escalation.

This update also fixes a guest-triggerable memory corruption in
VNC handling.

For the stable distribution (squeeze), this problem has been fixed in
version 0.12.5+dfsg-5+squeeze8.

For the unstable distribution (sid), this problem has been fixed in
version 1.0+dfsg-5.

We recommend that you upgrade your qemu-kvm packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk8i7mgACgkQXm3vHE4uyloQRACgsQu+mxJnMzKKDq683Yxg+JMD
yXQAn0PJYK+cw1cY4diZoY5aANodCP2h
=QgjH
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
Archive: http://lists.debian.org/20120127183710.GA6079@pisco.westfalen.local

[SECURITY] [DSA 2395-1] wireshark security update

2012-01-27T10:10:00.000-08:00

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2395-1 security@debian.org
http://www.debian.org/security/ Moritz Muehlenhoff
January 27, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : wireshark
Vulnerability : buffer underflow
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-3483 CVE-2012-0041 CVE-2012-0042 CVE-2012-0066
CVE-2012-0067 CVE-2012-0068

Laurent Butti discovered a buffer underflow in the LANalyzer dissector
of the Wireshark network traffic analyzer, which could lead to the
execution of arbitrary code (CVE-2012-0068)

This update also addresses several bugs, which can lead to crashes of
Wireshark. These are not treated as security issues, but are fixed
nonetheless if security updates are scheduled: CVE-2011-3483,
CVE-2012-0041, CVE-2012-0042, CVE-2012-0066 and CVE-2012-0067.

For the stable distribution (squeeze), this problem has been fixed in
version 1.2.11-6+squeeze6.

For the unstable distribution (sid), this problem has been fixed in
version 1.6.5-1.

We recommend that you upgrade your wireshark packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk8i6FwACgkQXm3vHE4uylrDkQCg5khLjhIkYAbItri576Q4ufHt
BFwAnjQINWnTLRDCg3CLlZOX6ke/Wn3T
=o4sR
-----END PGP SIGNATURE-----

2012-01-27T08:13:00.001-08:00

Your email has won for you

Changes to Google Privacy Policy and Terms of Service

2012-01-27T07:42:00.001-08:00

		Is this email not displaying properly? View it in your browser.
Dear Google user, We're getting rid of over 60 different privacy policies across Google and replacing them with one that's a lot shorter and easier to read. Our new policy covers multiple products and features, reflecting our desire to create one beautifully simple and intuitive experience across Google. We believe this stuff matters, so please take a few minutes to read our updated Privacy Policy and Terms of Service at http://www.google.com/policies. These changes will take effect on March 1, 2012.
One policy, one Google experience

Easy to work across Google Our new policy reflects a single product experience that does what you need, when you want it to. Whether you're reading an email that reminds you to schedule a family get-together or finding a favorite video that you want to share, we want to ensure you can move across Gmail, Calendar, Search, YouTube, or whatever your life calls for with ease.	Tailored for you If you're signed into Google, we can do things like suggest search queries – or tailor your search results – based on the interests you've expressed in Google+, Gmail, and YouTube. We'll better understand which version of Pink or Jaguar you're searching for and get you those results faster.	Easy to share and collaborate When you post or create a document online, you often want others to see and contribute. By remembering the contact information of the people you want to share with, we make it easy for you to share in any Google product or service with minimal clicks and errors.

Protecting your privacy hasn't changed Our goal is to provide you with as much transparency and choice as possible, through products like Google Dashboard and Ads Preferences Manager, alongside other tools. Our privacy principles remain unchanged. And we'll never sell your personal information or share it without your permission (other than rare circumstances like valid legal requests).	Got questions? We've got answers. Visit our FAQ at http://www.google.com/policies/faq to read more about the changes. (We figured our users might have a question or twenty-two.)

Notice of Change March 1, 2012 is when the new Privacy Policy and Terms will come into effect. If you choose to keep using Google once the change occurs, you will be doing so under the new Privacy Policy and Terms of Service. Please do not reply to this email. Mail sent to this address cannot be answered. Also, never enter your Google Account password after following a link in an email or chat to an untrusted site. Instead, go directly to the site, such as mail.google.com or www.google.com/accounts. Google will never email you to ask for your password or other sensitive information.

6 security companies to watch

2012-01-27T07:00:00.000-08:00

Hacking stunt: Stealing smartphone crypto keys using plain old radio | 15 worst Internet privacy scandals of all time

Network World Security

Forward this to a Friend >>>

In this Issue

WHITE PAPER: CA Technologies

Tackling the New Normal: Unified Infrastructure Management
The new normal for IT is change; and it's up to you to keep pace with that change. You need to leverage innovationslike cloud and mobilitywith a cohesive approach to management that ensures full visibility and control across the infrastructure. Learn More

15 worst Internet privacy scandals of all time
In honor of National Data Privacy Day this Saturday, Jan. 28, we've put together a list of the 15 worst Internet privacy scandals of all time. Read More

Hot security upstarts
Offering new email security technology and services to help clean up after a breach, these new companies are leading a wave of hot security startups Read More

WHITE PAPER: Bradford Networks

(BYOD) Unleashed in the Age of IT Consumerization
IT departments need to understand what devices are trying to connect to their networks, so they can provide convenient, secure access to those that are authorized, including personal iPads and smartphones. This white paper explains how IT departments can implement a practical and secure strategy and offer the convenience mobile devices provide. Read more

EU data protection proposes big fines for businesses
The European Commission announced a data protection bill this week that it hopes will safeguard citizen's online privacy. Read More

Data Privacy Day: Social media 'private' data is fair game for e-discovery in court
This Saturday, Jan. 28, is Data Privacy Day and it would be a great time to ponder our cyberculture, how much you share online and how well you manage your online reputation. In an increasingly connected world, everything people do online, from emailing, texting, uploading photos, making purchases online, to clicking the "like" and "retweet" buttons on favorite web pages, all contribute to their online... Read More

Are we winning the cyber security war?
In the cat and mouse game that is enterprise security, it is hard to determine who has the upper hand, so we put the question to two experts. Give their arguments a read, vote on the position you most agree with and add your thoughts in the forum. Read More

WHITE PAPER: Quantum

Big Data: Managing Explosive Growth
Are you experiencing a data explosion? The trend toward leveraging Big Data for competitive advantage helps IT professionals successfully meet business goals. Learn how to reliably manage, store and access vast amounts of archived data while protecting it and keeping costs low. View Now

Symantec recommends disabling pcAnywhere and waiting for security patches
Security vendor Symantec has advised users of its pcAnywhere remote control software to disable it, because hackers with access to the product's source code could exploit security holes identified in the application. Read More

Google stirs up privacy hornet's nest
Google has whipped up a privacy brouhaha with a blog post announcing that the company is rewriting its privacy policy, consolidating user information across its services. Read More

A vision for secure mobility management in the enterprise
There's been a lot of buzz lately about secure mobility in the enterprise, but often the focus is on just one or two aspects of the entire mobile device security landscape. While malware protection, mobile device management (MDM) and VPN are certainly valuable tools in protecting mobile devices, each of these strategies alone can provide only partial protection. And in a bring your own device (BYOD) corporate environment, the risks of "only partial protection" can be quite large. Read More

A quick look: The Megaupload Kim Dotcom hullabaloo
Megaupload.com's CEO Kim Dotcom is at the center of file sharing website's battle with the US over copyright, pirating and money laundering charges Read More

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_security_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

6 security companies to watch

2012-01-27T06:30:00.000-08:00

15 worst Internet privacy scandals of all time | More of the world's coolest data centers

Network World Compliance

Forward this to a Friend >>>

WEBCAST: HP, Microsoft & Intel

Database Consolidation and Building Your Private Cloud
Please join guest speaker IDC Analyst Carl Olofson as he discusses Enterprise Data Center challenges and why database consolidation is important and necessary. And hear from HP expert Joe Sullivan, who will discuss the HP Database Consolidation Appliance and how it addresses enterprise industry challenges. Learn more

In this Issue

RESOURCE COMPLIMENTS OF: CloudPassage

CloudPassage
Infrastructure-as-a-Service (IaaS) is one of the fastest-growing cloud computing sectors. However, cloud providers usage agreements squarely make the user responsible for protecting servers, applications and data. CloudPassage Halo is the award winning cloud server security platform that has everything you need to secure your cloud servers. Read More

More of the world's coolest data centers
We take another look to highlight some of the most innovative and unique data centers on the planet Read More

Can cloud-based collaborative data-sharing be secure enough for defense systems?
Though wariness about the perceived lack of security in cloud-based services is often voiced, there are some situations where the opposite is the case. Some businesses mindful of security say the cloud services that are important to them have done a lot of work to meet their expectations about security. Read More

WHITE PAPER: NetIQ

First Industy-Wide BSM Maturity Benchmark Study
This first-of-its-kind benchmark study reporting the IT and Business maturity illustrating the business service management imperative today. The survey offers insight into the current and future state of the Business Service Management imperative across global organizations. Learn More

2012's 25 Geekiest 25th Anniversaries
A look back at the most memorable events and products from 1987 Read More

SOPA's big brother signed by EU nations amid widespread protests
The European Union signed up to the controversial Anti Counterfeiting Trade Agreement (ACTA) on Thursday despite widespread opposition, particularly in Poland where people took to the streets in protest. Read More

Accused Kelihos botmaster's former employer 'angered' at revelation
A security-related company that until late December employed the Russian developer who allegedly created the Kelihos botnet said today it was 'extremely disappointed and angered' at the revelation. Read More

WHITE PAPER: Radware

The ADC in the Cloud Challenge
The cloud era has arrived. The cloud will very likely play a role in your network. It can be a cost-effective way to handle peak loads, seasonal variations in traffic and new application growth. Senior management has seen the ads and is pushing your enterprise to at least explore, if not join, the cloud movement. What do you do? Learn More

Threatened by Anonymous, Symantec tells users to pull pcAnywhere's plug
Symantec this week told users of its pcAnywhere remote access software to disable or uninstall the software while it fixes an unknown number of bugs. Read More

Teleconferencing vendors defend product security features
Teleconferencing vendors say they're trying to strike the right balance between security and usability after security researchers found they could dial in to the conference lines of major companies and manipulate video cameras to spy on boardrooms. Read More

U.S. government online security website hacked
Hackers under the AntiSec banner appeared to have hacked late Monday the website of OnGuardOnline.gov, the U.S. federal government's online security website, in protest against controversial legislation. Read More

Do you need a cyberumbrella?
If your company were hit with a cyberattack today, would it be able to foot the bill? The entire bill, including costs from regulatory fines, potential lawsuits, damage to your organizations' brand, and hardware and software repair, recovery and protection? Read More

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_compliance_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

Weekly Apple iPad 3 rumor roundup

2012-01-27T06:06:00.000-08:00

Hot security upstarts | First 'Super Wi-Fi' network goes live in North Carolina

Network World Daily News AM

Forward this to a Friend >>>

iPad 3 rumor rollup for the week of Jan. 26
As the faithful gathered in San Francisco this week for Macworld|iWorld, their faith seemed rewarded by a new spate of iPad 3 rumors. Read More

In this Issue

WHITE PAPER: NetSupport Inc

Reducing Hidden Operating Costs Through IT Asset Discovery
After reductions in headcount and procurements have been made, cost-cutting strategies are now turning to internal operations, and many IT decision makers are taking a closer look at indirect, or "soft," costs within these departments. Learn More

Hot security upstarts
Offering new email security technology and services to help clean up after a breach, these new companies are leading a wave of hot security startups Read More

First 'Super Wi-Fi' network goes live in North Carolina
Lucky residents of Wilmington, N.C., will be the first in the nation to have access to a "Super Wi-Fi" network. Read More

Company uses iPads instead of laptops in loaner program
A fast-growing media company has hit upon an iPad loaner program, which replaces laptops for occasional travelers. The Apple tablet's simplicity compared to the laptop makes it much easier to administer and use. Read More

WEBCAST: HP, Microsoft & Intel

Gaining A Competitive Advantage With Your Data
Fact: The demand to respond faster and with greater insight to business demands, based on data, is increasing. Fact: More organizations are turning to business intelligence (BI) and data warehousing for insightful decision-making. Learn more

Cisco CEO says Russia, China top US for business
Is Russia better for business and a better place to do business than the US? Cisco CEO John Chambers thinks so. Read More

FBI seeking help to monitor social media
So the FBI is in the market for a technology partner that will allow it to monitor social networks? You mean they're not doing this already? From a report on New Scientist: Read More

WHITE PAPER: NetIQ

Streamlining IT Operations with Business Service Management
This IDC Technology Spotlight examines the benefits of a business service management practice and tools in response to IT environments becoming more dynamic and complex due to the increased use of virtualization, cloud, SOA, and n-tier application architectures. Learn More

Android tablets finally catching on, says Strategy Analytics
It's taken a while but Android tablets may finally be starting to make a dent in Apple's share of the overall tablet market. Read More

10 best new Google Android apps for fun and, uh, work
Wikipedia, Airbnb among those launching official Android Market apps Read More

Video conferencing mistakes make espionage easy, say researchers
Tens of thousands of video conferencing setups, including some in corporate meeting rooms where the most confidential information is discussed, are vulnerable to spying attacks, researchers said. Read More

Tips for Facebook Timeline Apps: Beware What You Share
Facebook hopes this new class of apps will keep you on its site longer, but you can expect something else, too: a lot more noise in your Ticker and News Feed and an influx of over-sharing. Here's a look at the settings you need to know. Read More

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_daily_news_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

My Thoughts on IBM, NEC, and OpenFlow

2012-01-27T06:00:00.000-08:00

Cisco ASDM GUI tips and tricks for managing your Cisco ASA | Enterasys Embraces Unified Networking OneFabric Edge, and Another New Farpoint Group White Paper

Network World Cisco

Forward this to a Friend >>>

My Thoughts on IBM, NEC, and OpenFlow
IBM and NEC announced this week that the two companies will work together to offer networking solutions based upon SDN and OpenFlow. IBM provides the switches which are integrated with the NEC Programmable Flow Controller. To me, this is bigger than just a press release and some joint marketing programs. Here's why: Read More

WHITE PAPER: Juniper

Differentiated Architectures for the Data Center
Evolving needs require different architectures, making the same network does all design a thing of the past. The data center network now requires a very different architecture from the campus network in order to successfully deliver applications. Read for more information. View Now

In this Issue

WHITE PAPER: Raritan

Why Managing VMs is So Complex
Because virtual servers coexist with nonvirtualized ones, it effectively doubles the tools and efforts relevant to data center administration. Discover how a unified, out-of-band approach that aggregates management tools into a single, consolidated platform, renders the virtual and physical layers transparent from an IT management perspective. Read now!

Cisco ASDM GUI tips and tricks for managing your Cisco ASA
Cisco's Adaptive Security Device Manager (ASDM) is the GUI tool used to manage the Cisco ASA security appliances. In this blog I'll reveal to you some of my favorite tips, tricks and secrets found inside ASDM. If you haven't dealt with it before, ASDM is a free configuration, monitoring and troubleshooting management tool that comes with the ASA. In a nutshell, ASDM will manage all the features... Read More

Enterasys Embraces Unified Networking OneFabric Edge, and Another New Farpoint Group White Paper
Enterasys Networks yesterday announced extensions and new products under the umbrella of OneFabric Edge that augment their OneFabric architecture, announced a few months ago. There's quite a bit here - wireless LANs, a new line (the K-Series) of switches, and, most importantly, unified wired/wireless management. Read More

WHITE PAPER: Akamai Technologies, Inc.

Understanding Web Application Security
This paper examines current trends in Web application security, assessing the present threat environment as well as limitations in existing approaches to protection. Learn more

WHITE PAPER: Riverbed

Setting Consolidating Expectations
New survey results from Forrester Consulting on consolidating branch offices are now available. Read: - Best practices in the face of more users, services, and devices - Consolidating beyond just servers - The importance of deploying advanced WAN optimization Read now.

Information Security Budgets Will Increase in 2012
As part of our annual IT Spending Intentions survey, ESG asks IT professionals about overall spending trends for the coming year. Like other analyst firms, ESG found that IT budgets will increase in 2012, albeit at a modest rate. Read More

@#*! End Users say: The Video
Afraid to say that jumping on the "@#*! X say" meme taking the Internet by storm isn't beneath us this week. Without further ado, "@#*!End Users Say" Read More

Fear the tablet: Cisco survey
Fear the personal device at work. Your IT manager does. Read More

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_cisco_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

Invitation, Plus the Future of Cloud & Networks

2012-01-27T05:01:00.000-08:00

Cloud Computing Preparation Guide

Data Replication Webcast Invitation

Overview of Server Virtualization Trends

Networking Technology Insights

Welcome to your Friday newsletter. This week, we've got papers on the future of cloud computing, an overview of servers costs and trends, and a guide to why the network is becoming more important. Plus, you're invited to a webcast which will discuss how data replication technologies can benefit businesses. Click here to read our new blog on the popularity of Apple products - do you think the company can keep it up? Leave us a comment to let us know what you think.

Cloud Computing: Preparation Guide for Future Technology

It is likely that your organization is considering or has already implemented cloud strategies to improve the function of the data center. Along with the promise of significant benefits, the cloud also places greater demands on the data center. This guide provides practical information to help you prepare your data center for the cloud. Discover the latest technology available for your virtualized data center.

Data Replication: How First Data Gained Business

More and more, business success depends on the continuous availability of data. Companies look increasingly to data replication solutions as a way to get the continuity of data they need. In this webcast on February 28th, you will hear how First Data Corp doubled its business processing for a large government agency. Discover how it was able to provide rapid failover and switchback for its IBM DB2 databases. You will also learn how data replication solutions have been improved from disaster recovery to active-active databases- register now!

Server Virtualization: Expert Overview of Costs, Trends and More

When implemented properly, server virtualization can help your organization achieve many benefits. To make the most of virtualization initiatives it is important to understand the different costs involved, as well as the disaster recovery efforts required. This expert guide outlines the different costs associated with server virtualization, reveals six predictions for the future and explains how you can benefit from a virtual hardware platform - download your server virtualization guide today!

Network Management: Why the Network is Your Business

From mainframes to thin client to virtualized environments of servers, VLANs and network gear, the network has grown both more complex and more important in recent years. This white paper discusses the new networking technologies that are taking over the business, and explains why effective network management matters more than ever in today's real-time business environment.

Kind regards

Kasey Cassells
e-Editor
IDG Connect

Forward this mailer to a Friend/Colleague

Find us on:

Facebook

Twitter

RSS Feed

Subscribe to topical weekly email Roundups from IDG Connect.

If you do not wish to receive any further emails click here

Contact us if you need any assistance or additional information.

IDG Connect's Privacy Policy Copyright © 2012. All rights reserved.
IDG Connect, 492 Old Connecticut Path, Framingham, MA 01701.
www.idgconnect.com

HAJJ & UMARAH

2012-01-27T03:15:00.001-08:00

Study: Mobile devices to be prime delivery platform for UC services

2012-01-27T03:04:00.000-08:00

January 27, 2012

Create or Manage Your Profile

Communications Update	Brought to you by

Study: Mobile devices to be prime delivery platform for UC services

A survey commissioned by BroadSoft finds total shift to a mobile workforce is coming sooner than expected. Read more >>

8 Reasons You Need Hosted VoIP

Sponsored by 8x8
Hosted VoIP is one of the fastest-growing technologies for business today. Download this guide for eight reasons your business needs to make the switch to hosted VoIP to save on telecommunications costs, increase collaboration and focus on growing your business. Click Here >>

Asterisk turns 10

Latest version of the open-source IP PBX engine emphasizes high-quality audio plus video conferencing. Read more >>

	Vidyo plugin integrates telepresence with Microsoft Lync.
	New VoIP appliances from Cisco target small, mid-size businesses
	Cisco announces cross-platform UC.
	Verizon to offer UC service in the cloud.
	RHUB v. 4.3 now has HD VoIP capability.

	Video White Paper: Stop Babysitting Your Applications
	Critical IT Security Protection--Build, Monitor and Defend Your Company
	The Social CRM Playbook
	White Paper: Mission-Critical Java

Job Title: C / C++ Architect-software-API High-Performance UNIX or Windows Programming

Company: WSI Nationwide, Inc.

Location: US-NY-New York

Enterprise Mobility for Dummies

Toshiba announces cordless IP business phone

New IP 4000 system uses SIP signaling and a DECT radio for excellent range and sound quality. Read more >>

VoIP forms core transport for new wireless service

republic wireless, a startup division of Bandwidth.com, uses Wi-Fi as its primary network, with 3G cellular backup. Read more >>

You are subscribed to an ITBusinessEdge.com newsletter as security.world@gmail.com. To unsubscribe from this newsletter, please click here.

If you wish to be removed from all of our future emails, please click here.

To unsubscribe via postal mail, please contact us at:

ITBusinessEdge a property of QuinStreet, Inc.
Attn: Newsletter Subscription Dept.
950 Tower Lane, 6th Floor
Foster City, CA 94404

Please include the email address which you have been contacted with.

Clearance event is going on now!

2012-01-26T22:25:00.001-08:00

You won't believe what we have on clearance - take a look!
View online | View text version

Offer good through 1/29/12.

Clearance items may not be in all stores; some may be demos. Sorry, no rain checks, phone orders or Direct2U orders.

To ensure delivery to your inbox, please add radioshack@e.radioshack.com to your address book.

RadioShack has a strict NO SPAM policy.
Unsubscribe | Privacy Policy | Terms and Conditions | Customer Service | 1-800-THE-SHACK^®

This is an advertisement from RadioShack. © 2012 RadioShack Corporation. All rights reserved.
RadioShack Riverfront Campus — 300 RadioShack Circle, Fort Worth, TX 76102

[SECURITY] [DSA 2394-1] libxml2 security update

2012-01-26T14:46:00.000-08:00

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- -------------------------------------------------------------------------
Debian Security Advisory DSA-2394-1 security@debian.org
http://www.debian.org/security/ Luciano Bello
January 27, 2012 http://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package : libxml2
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-0216 CVE-2011-2821 CVE-2011-2834 CVE-2011-3905
CVE-2011-3919
Debian Bug : 652352 643648 656377

Many security problems had been fixed in libxml2, a popular library to handle
XML data files.

CVE-2011-3919:
JÃ¼ri Aedla discovered a heap-based buffer overflow that allows remote attackers
to cause a denial of service or possibly have unspecified other impact via
unknown vectors.

CVE-2011-0216:
An Off-by-one error have been discoveried that allows remote attackers to
execute arbitrary code or cause a denial of service.

CVE-2011-2821:
A memory corruption (double free) bug has been identified in libxml2's XPath
engine. Through it, it is possible to an attacker allows cause a denial of
service or possibly have unspecified other impact. This vulnerability does not
affect the oldstable distribution (lenny).

CVE-2011-2834:
Yang Dingning discovered a double free vulnerability related to XPath handling.

CVE-2011-3905:
An out-of-bounds read vulnerability had been discovered, which allows remote
attackers to cause a denial of service.

For the oldstable distribution (lenny), this problem has been fixed in
version 2.6.32.dfsg-5+lenny5.

For the stable distribution (squeeze), this problem has been fixed in
version 2.7.8.dfsg-2+squeeze2.

For the testing distribution (wheezy), this problem has been fixed in
version 2.7.8.dfsg-7.

For the unstable distribution (sid), this problem has been fixed in
version 2.7.8.dfsg-7.

We recommend that you upgrade your libxml2 packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: http://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iEYEARECAAYFAk8h1n8ACgkQQWTRs4lLtHnXgACfV+dXC4Yc/aNb5udhKMYsEryT
mXAAoLetgUJRnDACae5LC9qnegUiNHRt
=j/Is
-----END PGP SIGNATURE-----

15 worst Internet privacy scandals of all time

2012-01-26T12:27:00.000-08:00

What's hot at Macworld|iWorld 2012 | Google's new cross-service info sharing: Why the hubbub?

Network World Daily News PM

Forward this to a Friend >>>

WHITE PAPER: Cisco Systems, Inc.

The Right Unified Communications Solution
The advantages of today's unified communications are numerous, and there are many choices among solutions. A Cisco white paper is available to help you make the right decision. The paper outlines ten differentiators--from mobile device support to social software--that you should consider before deciding on a unified communications upgrade. Click to continue

In this Issue

RESOURCE COMPLIMENTS OF: CIO Leadership

CIO Leadership Announces Keynote EVP & CIO Alan Matula
Don't miss EVP and CIO Alan Matula share his perspectives on how a multi-sourcing IT strategy can effectively drive cost efficiencies and innovations that support Shell's business strategies worldwide at The CIO Leadership Event, April 29 - May 1, 2012 at The Marco Island Marriott Beach Resort in Florida - Register Today! Click to continue

What's hot at Macworld|iWorld 2012
Macworld|iWorld seems to bring out the best, and sometimes the worst, in Apple-related creativity. Check out what's new, cool, and just strange at this year's show. Read More

Google's new cross-service info sharing: Why the hubbub?
How you feel about Google's newest information-sharing policy all boils down to how comfortable you are with Google knowing your every move online. Read More

John Deere plows into agile
John Deere & Co., has moved about 800 software developers into an agile development process, and did so in just over a year. Read More

Website fixes 'missed connections,' engenders envy
How many times have you been seated in an airplane next to an attractive member of the opposite sex - or same, if you're so inclined -- and the two of you trip the flight fantastic to such an extent that romance seems inevitable ... if only before departing the arrival gate you had remembered to exchange contact information? Dreams don't count. Read More

AT&T chief bashes FCC, pleads for more spectrum
AT&T CEO Randall Stephenson is still unhappy that the Federal Communications Commission helped foul up his company's merger with T-Mobile. Read More

Japan touts optical communications breakthrough
The National Institute of Information and Communications Technology (NICT) is touting an optical communications technology breakthrough based on its work with semiconductor quantum dots. NICT says its efforts will enable optical transmissions using a wavelength band that covers 10 times the width of the band typically used now. Applications could include telecommunications as well as medical, including... Read More

Android's tablet share at 39 percent as sales triple, says study
Sales of Android-based tablets more than tripled during the fourth quarter of 2011. But Apple still dominates, even as its market share dropped, according to Strategy Analytics. Read More

Time Management: 6 Ways to Improve Your Productivity
Workplace performance expert Jason Womack offers six of his most effective tips for better managing your time and giving your productivity a jolt. Read More

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_daily_news_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

Three simple steps to better patch security

2012-01-26T11:34:00.000-08:00

Why common patch solutions aren't enough

Learn More

Three simple steps to better patch security

Security experts estimate that 90% of successful attacks against software vulnerabilities could be prevented with an existing patch or configuration setting. Still, many computers in organizations remain unpatched and unprotected. In this whitepaper, we'll explain three best practices for improving your security and compliance with patch assessment.

Learn More

Forward to a Friend >>

Additional Resources

What To Do When Legal Requests Mobile Data Archives

Meet the regulatory and business requirements of long-term message storage.

SUBSCRIPTION SERVICES

You are currently subscribed as security.world@gmail.com
If you do not wish to receive future mailings from Computerworld Online Resources, unsubscribe.

View Computerworld's online privacy policy.

Storage IaaS What You Need to Know

2012-01-26T10:30:00.000-08:00

See How Cloud Storage Provides Global Data Access with Local Performance. Learn more

Bringing the Cloud to the Data Center

Storage IaaS is an ideal strategy for small and midsize businesses to meet growing storage demands. This Q&A videocast explains how combining an appliance locally with the cloud delivers a simple and secure way to protect data. Hear about:

* Global access to a single version of files synched within a minute
* AES encryption within the appliance means data is secured in transit and at rest
* Provisioning new storage in increments as small as 1 TB

Learn More

Forward this to a Friend >>

The Backbone of Doing Business Over the Internet
Security of personal data transmissions has never been more critical. Read more >>

SUBSCRIPTION SERVICES
You are currently subscribed as security.world@gmail.com. If you do not wish to receive future mailings from InfoWorld Online Resources, need to change your email or other preference, please visit us here.

View InfoWorld's online privacy policy.

Copyright 2012 | InfoWorld | 492 Old Connecticut Path | Framingham MA 01701 | www.InfoWorld.com

Key Considerations in DR Planning

2012-01-26T10:15:00.000-08:00

New solutions for offsite data protection. Learn more

New Solutions for Offsite Data Protection

Traditional DR plans fail to adequately protect against irretrievable data loss be it from natural disaster, software corruption, hardware failure, or simple human error. Download this white paper and learn how offsite data protection in the cloud can meet your DR needs.

Learn More

Forward this to a Friend >>

The Backbone of Doing Business Over the Internet
Security of personal data transmissions has never been more critical. Read more >>

The Rise of Tablet Computing: New 2012 iPad Trends

2012-01-26T09:06:00.000-08:00

2012 iPad for Business Report

Latest iPad Trends & Opinion

Report on Today's Tablet Wars

2011 was a big year for tablet devices, and this trend is set to carry on throughout 2012 as vendors step up to compete with Apple's incredibly popular offering, the iPad. So just how loyal are users to their iPads and what impact is this having on businesses? Read on to gain an insight with our latest blog, brand new report and paper on trends for the different tablets available. Do you use a tablet? Then take our quick poll and let us know which device you use.

New Report: iPad Usage Trends

This week we released our brand new research report 'iPad for Business Survey 2012'. The report looks into what the iPad is used for, and also throws up some startling results regarding loyalty to the Apple brand. An astounding 83% surveyed said they would not consider buying a different tablet next time. Get the full report to discover the very latest iPad trends, and see how this device is being used across the world.

Latest Opinion: Can the iPad's Reign Last?

In our brand new blog post, our editor looks at the latest iPad trends from our iPad for Business Survey. With the iPad now the 'must-have' technological device for many consumers and business users, can Apple keep it up? And will other tablets on the market be able to topple Apple from the top of the most wanted list? Read the post now and leave a comment to let us know what you think.

Tablet Trends: Top 3 Device Sales

The rapid growth of tablet computing is not only having an impact on the consumer market, devices such as the iPad are increasingly being used for business - our research shows that 91% of respondents with an iPad use it for work communication. This white paper charts the rapid rise of tablet computing, the common issues raised and the latest statistics between the main tablet competitors - Apple, Android and RIM. Click here to read it now.

Kind regards

Kasey Cassells
e-Editor
IDG Connect

P.S: Don't forget to take our poll - which tablet do you use?

Forward this mailer to a Friend/Colleague

Find us on:

Facebook

Twitter

RSS Feed

Subscribe to topical weekly email Roundups from IDG Connect.

If you do not wish to receive any further emails click here

Contact us if you need any assistance or additional information.

Nomination Deadline Tomorrow 1/27

2012-01-26T07:55:00.000-08:00

Don't forget, the deadline to submit your nomination for the Computerworld Honors program is tomorrow, Friday, January 27th.

Get your nomination in today and get recognized for your innovative IT achievements.
http://cwhonors.org/nominations/Nomination_Form.asp

As a Computerworld Honors Laureate, you'll generate national recognition and priceless goodwill for your organization. You'll be in great company, competing for an internationally respected award that symbolizes IT innovation for the greater good. And you'll have the opportunity to share the stage with world-class IT leaders at the Computerworld Honors Program on June 4, 2012 in Washington, D.C.

Take your place among recent honorees and winners, such as:
New York City Police Department for Crime Data Warehouse
Zipcar for Car Sharing
NASA Ames Research Center CIO
ING
Australian Government, Department of Defence for Learning Management System
Stanford University
United States Department of Homeland Security
OnStar for Advanced Automatic Crash Notification (AACN)

Click here to preview the application questions and submit your nomination:
http://cwhonors.org/nominations/Nomination_Form.asp

ABOUT THE COMPUTERWORLD HONORS PROGRAM
Laureates' achievements will be recognized publicly at the Laureate Medal Ceremony and Awards Gala being held at the Andrew W. Mellon Auditorium in Washington D.C. on June 4th, 2012. During this black tie ceremony, honorees are presented with a medallion inscribed with the Program's mission, "A Search for New Heroes." Additional recognition is given to five Laureates in each category who, selected by Program Judges to represent outstanding innovation, become Finalists for the 21st Century Achievement Award. One Finalist in each category is then named a 21st Century Achievement award winner, receiving special recognition by the Program Judges to be the very best among their peers.

Don't miss your opportunity to be recognized at the 24th annual Computerworld Honors program. Deadline to submit your nomination is tomorrow, Friday, January 27th.

Get your nomination in today.
http://cwhonors.org/nominations/Nomination_Form.asp

ITworld is a sister company of Computerworld.

Forward this to a Friend >>>

SUBSCRIPTION SERVICES

You are currently subscribed as security.world@gmail.com. If you do not wish to receive future mailings from ITworld regarding Computerworld Honors, need to change your email or other preference, please visit us here.

View ITworld's online privacy policy .

Wireless bandwidth: Are we running out of room?

2012-01-26T07:42:00.000-08:00

IBM, NEC team on OpenFlow | Apps eat more bandwidth than browsers

Network World Network Optimization

Forward this to a Friend >>>

Wireless bandwidth: Are we running out of room?
Wireless bandwidth is like land in Manhattan -- it's extremely valuable because they're not making more of it. Read More

WHITE PAPER: Splice Communications

Offloading Telecom Delivers a Big Payback for IT
Inaccurate invoices, complicated contracts, slow provisioning and poor support from Telecom carriers wastes time, money and resources. Learn the difference a custom data network solutions provider can deliver. Read Now!

In this Issue

IBM, NEC team on OpenFlow
IBM and NEC have partnered to offer OpenFlow-based networking products to joint customers. Read More

Apps eat more bandwidth than browsers
As iPads, iPhones, Nooks, Kindles, and other mobile devices multiply like rabbits and join the established population of desktop and laptop computers, the nature of traffic to and from all device types is changing. The key reason for this change is that users are downloading more apps, which replace the browser for completing most tasks. Read More

Three warning signs of a user-unfriendly app
A user-friendly interface is paramount if you want employees and external users to adopt an enterprise application. But what, precisely, makes an app user-friendly? That's a complicated science, with detailed books and research papers devoted to it. But if your app has any of the following three elements, that's probably not a good sign. Read More

FBI seeking help to monitor social media
So the FBI is in the market for a technology partner that will allow it to monitor social networks? You mean they're not doing this already? Read More

Goal of new security service: More involvement from ISPs, carriers
New security analytics service purports to arm service providers with the information they need to keep their network traffic clean. Read More

The fine art of Fibre Channel troubleshooting
Troubleshooting Fibre Channel networks can be as much an art as it is a science, but there are some basic best practices you can follow to reduce the guessing and speed resolution. Here are 10 tips to help you get to the bottom of pesky problems. Read More

WEBCAST: Riverbed

5 Steps to Successful IT Consolidation
Mapping out a 5 step consolidation process can ensure that the goals of IT consolidation are achieved. Read this white paper to learn how to reduce IT management overhead, ease revision control, guarantee data security, scale systems more quickly and reduce server and software costs. Read More

No more historic SLA reports: Get it (and fix it) in real time
Businesses of almost all types are increasingly dependent on service providers for network connectivity that consistently delivers certain performance characteristics. In addition to basic service availability, these characteristics increasingly include peak, average and minimum bandwidth utilization, latency (delay) and latency variation (jitter), and packet loss -- all of which can affect operational efficiency and end user satisfaction. This is especially the case with Ethernet-based service offerings employing packet transport to deliver E-LINE services operating at speeds up to tens of gigabits per second. Read More

My thoughts on IBM, NEC, and OpenFlow
IBM and NEC announced this week that the two companies will work together to offer networking solutions based upon SDN and OpenFlow. IBM provides the switches which are integrated with the NEC Programmable Flow Controller. To me, this is bigger than just a press release and some joint marketing programs. Here's why. Read More

Enhance I/O in a virtualized environments using NIC partitioning
With virtualization comes an increase in the amount and complexity of I/O traffic. Network interface cad (NIC) partitioning enhances I/O performance in a virtualized environment, advancing hardware consolidation and flexible bandwidth provisioning for heightened IT agility. Read More

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_network_optimization_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

Mozy releases 'Stash' file syncing service

2012-01-26T07:40:00.000-08:00

Prying government eyes hurting U.S. cloud services: EFF | Skype's new headquarters: a visual tour

Network World Cloud Computing

Forward this to a Friend >>>

Mozy releases 'Stash' file syncing service
Mozy released the beta of a new file synchronization service called Stash, which allows photos, videos or documents to be uploaded automatically to the cloud and shared across any device. Read More

RESOURCE COMPLIMENTS OF: Cisco

Improve Your Business Capabilities
Cisco enables businesses to realize the benefits of cloud computing - improved agility, better economics, enhanced security and a dynamic, assured experience. Cisco CloudVerse combines three key cloud elements - Unified Data Center, Cloud Intelligent Network, and Cloud Applications and Services. Learn more.

In this Issue

RESOURCE COMPLIMENTS OF: CloudPassage

CloudPassage
Infrastructure-as-a-Service (IaaS) is one of the fastest-growing cloud computing. However, cloud providers usage agreements squarely make the user responsible for protecting servers, applications and data. CloudPassage Halo is the award winning cloud server security platform that has everything you need to secure your cloud servers. Read More

Prying government eyes hurting U.S. cloud services: EFF
A blog post from the Electronic Frontier Foundation makes the case that the United States is jeopardizing its position in the worldwide cloud-computing market by failing to provide the kinds of privacy assurances demanded by international laws. Moreover, the authors contend that U.S. officials are speaking out of both sides of their mouths on the issue. Read More

Skype's new headquarters: a visual tour
Casual meeting areas and soaring ceilings create a colorful, light-filled space for Skype employees. Read More

Amazon Web Services moves backups to cloud with new appliance
Amazon Web Services has launched a public beta test of AWS Storage Gateway, which allows enterprises to back up application data in Amazon's cloud using a software appliance. Read More

AT&T to launch communication services
AT&T will launch new cloud-based unified communications services on Thursday, giving businesses the ability to integrate chat, email, voice over IP calls, audio and video conferencing over desktops and many mobile devices. Read More

Google to combine users' data across its services
Google will be able to combine data from several Google services when a Google Accounts user is signed in, as part of a rewritten set of privacy policies that the company announced on Tuesday. Read More

Motorola files new suit against Apple
Motorola on Tuesday filed a new lawsuit in Florida charging Apple with infringing six patents in the iPhone 4S and four of those patents in iCloud. Read More

Former NASA OpenStack researchers enter private cloud market with Piston Enterprise OS
Piston Cloud Computing co-founder Josh McKenty has laid out the same objective on several occasions, from speaking to attendees at the inaugural OpenStack design summit to addressing friends and colleagues at his company's launch party: "Let's finish where we started." Read More

Google Chrome remixes worth trying out
Chromium-based spinoffs bring privacy, security, social networking, and other interesting twists to Google's Chrome browser. Read More

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_cloud_computing_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **

Threatened by Anonymous, Symantec tells users to pull pcAnywhere's plug

2012-01-26T07:06:00.000-08:00

Say goodbye to Fast Ethernet | Are we winning the cyber security war?

Network World Daily News AM

Forward this to a Friend >>>

RESOURCE COMPLIMENTS OF: Commvault

Can you keep up with massive data growth?
Don't back up. Solve Forward with CommVault Simpana Software. Learn how at SolveForward 2012, an eye-opening virtual event exploring the challenges and solutions that will shape the modern data center. Register now.

In this Issue

RESOURCE COMPLIMENTS OF: Cisco Systems, Inc.

Converge Your Networks for Flexibility
Cisco Unified Fabric offers the industry's largest and first fully interoperable portfolio of Fiber Channel integrating storage and data networking to deliver transparent convergence, massive three-dimensional scalability and sophisticated intelligence. It also reduces your costs up to 45%. Learn More

Say goodbye to Fast Ethernet
The Layer 2-3 Ethernet switch market is forecast to approach $28 billion in 2016, with future growth driven primarily by sales of Ethernet switches optimized for larger data center deployments. Read More

Ten Things We Love and Hate About Window 8 Client Versions
With Windows 8, Microsoft will extend its dominant desktop operating system to tablets and smartphones. Windows 8 will also feature a new, tiled interface called Metro, which is optimized for touch-screen devices. Read More

Job hunting? Salary negotiation season is open
Job seekers are gaining leverage in salary discussions, according to new data from Robert Half International. Read More

Corporate PowerPoint files now play on iPad
Brainshark this week at Macworld | iWorld goes live with an enterprise version of its PowerPoint "translator" for the iPad. Read More

5 days after Microsoft voices support, Washington gets the votes to legalize same-sex marriage
Washington's state senate has gathered enough support to make it the seventh state to legalize same-sex marriage, after senator Mary Margaret Haugen announced on Monday she will cast the 25th and deciding vote in favor of the controversial bill. Read More

HP plans September open-source release for webOS
HP announced on Wednesday that it plans to release the code behind webOS in September under the Apache License, Version 2.0. Read More

The Gifts You Didn't Get: 2011 Geek Gadget Guide
No matter what was on your list, there's always room for a few more techno-toys. Read More

SLIDESHOWS

MOST-READ STORIES

Do You Tweet?
Follow everything from NetworkWorld.com on Twitter @NetworkWorld.

You are currently subscribed to networkworld_daily_news_alert as security.world@gmail.com.

Unsubscribe from this newsletter | Manage your subscriptions | Subscribe | Privacy Policy

If you are interested in advertising in this newsletter, please contact: bglynn@cxo.com

To contact Network World, please send an e-mail to customer_service@nww.com.

** Please do not reply to this message. If you want to contact someone directly, send an e-mail to customer_service@nww.com. **