New Oracle database hack found

Patches from Debian, Mandriva, Gentoo Huge Web hack attack infects 500,000 pages Microsoft mislabels Skype as adware, and other interesting reading

Researcher finds new way to hack Oracle database
Security researcher David Litchfield has released technical details of a new type of attack that could give a hacker access to an Oracle database. Called a lateral SQL injection, the attack could be used to gain database administrator privileges on an Oracle server in order to change or delete data or even install software, Litchfield said in an interview on Thursday. IDG News Service, 04/24/08.

David Litchfield's blog: A New Class of Vulnerability in Oracle: Lateral SQL Injection
**********

Three new updates from Debian:

To continue reading, register here and become an Insider. You'll get free access to premium content from CIO, Computerworld, CSO, InfoWorld, and Network World. See more Insider content or sign in.

Researcher finds new way to hack Oracle database
Security researcher David Litchfield has released technical details of a new type of attack that could give a hacker access to an Oracle database. Called a lateral SQL injection, the attack could be used to gain database administrator privileges on an Oracle server in order to change or delete data or even install software, Litchfield said in an interview on Thursday. IDG News Service, 04/24/08.

David Litchfield's blog: A New Class of Vulnerability in Oracle: Lateral SQL Injection
**********

Three new updates from Debian:

xulrunner (programming error, code execution)

phpmyadmin (multiple flaws)

perl (heap overflow, code execution)
**********

Two new fixes from Mandriva:

Wireshark (multiple flaws)

OpenOffice.org (heap overflows, code execution)
**********

Three new patches from Gentoo:

Comix (multiple flaws)

JRockit (multiple flaws)

SILC (multiple flaws)
**********

Today's malware news:

Fly Phishing
Some phishing gangs have a new technique. They're using trojan-spy applications. F-Secure blog, 04/25/08.

Huge Web hack attack infects 500,000 pages
Attacks on legitimate Web domains, including some belonging to the United Nations that began earlier this week, have expanded dramatically, security researchers said Friday, with hundreds of thousands of pages hacked by Friday. Computerworld, 04/27/08.

F-Secure: Mass SQL injection

iFrame attacks surge, security firm says
A flood of SQL injection attacks on Microsoft Internet Information Servers are leaving Web pages with malicious iFrames in them, and Panda Security is urging network managers to make sure their Web pages haven't been infected. Network World, 04/24/08.
**********

From the interesting reading department:

Microsoft mislabels Skype as adware
Skype users who have been getting strange error messages from Microsoft's security products over the past week can breathe easy now. It was all a mistake. IDG News Service, 04/23/08.

ISPs' Error Page Ads Let Hackers Hijack Entire Web, Researcher Discloses
Seeking to make money from mistyped website names, some of the United States' largest ISPs instead created a massive security hole that allowed hackers to use web addresses owned by eBay, PayPal, Google and Yahoo, and virtually any other large site. Wired, 04/19/08.

China worries hackers will strike during Beijing Olympics
While CNN recently faced distributed denial-of-service attacks from Chinese hackers angry about the television network's coverage of a recent Chinese crackdown in Tibet, Chinese security officials remain worried hackers will strike while the Olympic Games are being held in Beijing. IDG News Service, 04/24/08.

UConn bookstore sells drive holding personal data
University of Connecticut police are investigating how a hard drive containing personal documents and photos from about 10 students, faculty and non-university individuals was accidentally sold last week by the school's bookstore to a student on campus. Computerworld, 04/27/08.

Thieves pilfer backup tape holding 2M medical records
University of Miami officials last week acknowledged that six backup tapes from its medical school that contained more than 2 million medical records was stolen in March from a van that was transporting the data to an off-site facility. Computerworld, 04/26/08.