Not a good week for Apple

Apple issues mega-monster security update
Apple Tuesday issued a record-breaking security update that patched nearly 90 vulnerabilities in both its own code and the third-party applications it bundles with its Tiger and Leopard operating systems. Computerworld, 03/19/08.

Apple's Security Update 2008-002

Apple updates Safari browser, busts 13 bugs
Apple Inc. today patched 13 vulnerabilities in Safari with an update that takes the browser to Version 3.1. Only one of the patched bugs carried Apple's most dire warning -- that the flaw could result in "arbitrary code execution." Computerworld, 03/18/08.

Apple Safari 3.1 advisory

Apple updates AirPort Extreme Base Station
A new firmware update is out for Apple's 802.11n AirPort Extreme Base Station. Firmware version 7.3.1 fixes an input validation flaw that could be exploited in a denial-of-service attack agaist the unit.
**********

VMware fixes security bugs
VMware has identified and fixed seven security bugs in the free version of its hypervisor, which could let hackers launch denial-of-service, change user privileges and forge RSA key signatures. Network World, 03/17/08.

VMWare advisory

Secunia: VMware Server Multiple Vulnerabilities
**********

Malicious subtitle file could trip up VLC media player
A flaw in the widely-used open-source VLC media player could allow an attacker to execute harmful code on a PC. The problem stems from a buffer overflow that can occur when the player processes subtitle files used for movies, according to a security advisory. IDG News Service, 03/18/08.

SecurityVulns advisory
**********

Two flaws found in Kerberos 5
MIT is advising users of two flaws found in its Kerberos 5 network authentication protocol. Both flaws could be used in a denial-of-service attack against an affected system and there's a slight chance malicious code could be run as well. Patches are available.

MIT advisories:

MITKRB5-SA-2008-001: double-free, uninitialized data vulnerabilities in krb5kdc

MITKRB5-SA-2008-002: array overrun in RPC library used by kadmin

Two Linux vendors are already out with related patches:

Ubuntu: Kerberos vulnerabilities

Debian: krb5
**********

Multiple flaws in Asterisk patched
According to a Secunia advisory, "Some vulnerabilities have been reported in Asterisk, which can be exploited by malicious people to bypass certain security restrictions, cause a DoS (Denial of Service), and potentially compromise a vulnerable system." Patches are available.

Asterisk advisories:

AST-2008-005: HTTP Manager ID is predictable 

AST-2008-004: Format String Vulnerability in Logger and Manager

AST-2008-003: Unauthenticated calls allowed from SIP channel driver

AST-2008-002: Two buffer overflows in RTP Codec Payload Handling
**********

Nine new updates from Debian:

ikiwiki (cross-scripting flaw)

unzip (code execution)

lighttpd (file disclosure)

Smarty (function execution)

Horde3 (file execution)

backup-manager (password disclosure)

ldapscripts (password disclosure)

Dovecot (privilege escalation)

icedove (multiple flaws)
**********

Two new fixes from Mandriva:

unzip (invalid pointer, code execution)

Nagios (multiple flaws)
**********

Six new patches from Gentoo:

MoinMoin (multiple flaws)

Adobe Acrobat Reader (non-secure temp files)

Dovecot (multiple flaws)

PCRE (buffer overflow, code execution)

Website META Language (non-secure temp files)

LIVE555 Media Server (denial of service)
**********

From the interesting reading department:

Hannaford supermarket chain discloses data breach involving credit, debit cards
Portland, Maine-based supermarket chain Hannaford Brothers Monday disclosed it has suffered a data intrusion into its computer network that has resulted in the theft of customer credit and debit card numbers. (EEK! I've shopped at Hannaford stores from time to time!) Network World, 03/17/08.

Pennsylvania pulls plug on voter site after data leak
With voting in Pennsylvania's presidential primary just a month away, the state was forced to pull the plug on a voter registration Web site Tuesday after it was found to be exposing sensitive data about voters in the state. IDG News Service, 03/19/08.