Microsoft Patch Tuesday: Four patches fix mostly Office vulnerabilities
Microsoft Tuesday released four patches to fix six vulnerabilities, three of which were rated critical for Microsoft Word, Publisher and the Jet Database Engine 4.0. Experts say the fourth patch, rated important, could also be viewed as critical because it affects security software that could be shut down in an attack. Network World, 05/13/2008.

Microsoft advisories:

Vulnerabilities in Microsoft Word Could Allow Remote Code Execution

Vulnerability in Microsoft Publisher Could Allow Remote Code Execution

Vulnerability in Microsoft Jet Database Engine Could Allow Remote Code Execution

Vulnerabilities in Microsoft Malware Protection Engine Could Allow Denial of Service

Related:

Determining Microsoft Jet Database Engine vulnerability
Do we need to worry about the recently disclosed vulnerability in the Microsoft Jet Database Engine if we have Windows XP Service Pack 3 installed? Network World, 05/14/2008.

US-CERT: Microsoft Updates for Multiple Vulnerabilities
**********

Four vulnerabilities found in Cisco Unified Communications Manager
On May 14 Cisco issued a security advisory for Cisco Unified Communications Manager (formerly Cisco CallManager). Patches are now available to fix four denial of service (DoS) vulnerabilities all of which were discovered internally by Cisco. Cisco Subnet, 05/14/08.

Cisco advisories:

Cisco Unified Presence Denial of Service Vulnerabilities

Cisco Unified Communications Manager Denial of Service Vulnerabilities

Cisco Unified Communications Manager Denial of Service Vulnerabilities

Cisco Content Switching Module Memory Leak Vulnerability
**********

Seven new patches from Debian:

gforge (non-secure temp files, file overwrite)

openssh (predictable random key generation)

openssl (predictable random key generation)

linux-2.6 (denial of service)

icedove (multiple flaws)

rdesktop (multiple flaws)

PHP5 (multiple flaws)
**********

Two new fixes from Mandriva:

Perl (denial of service)

ImageMagick (heap overflows, code execution)
**********

Eight new updates from Gentoo:

OpenOffice.org (multiple flaws)

libid3tag (denial of service)

Common Data Format library (user-assisted code execution)

PTeX (multiple flaws)

Blender (multiple flaws)

Chicken (multiple flaws)

Pngcrush (user-assisted code execution)

MoinMoin (privilege escalation)
**********

Six new patches from Ubuntu (all OpenSSL related):

OpenSSL vulnerability

OpenSSH vulnerability

OpenVPN vulnerability

ssl-cert vulnerability

OpenSSH update

OpenVPN regression
**********

Today's malware news:

SQL Injection Attacks Becoming More Intense
The mass SQL injection attacks we've mentioned here and here are increasing in number and we're seeing more domains being injected and used to host the attack files. We believe that there is now more than one group using a set of different automated tools to inject the code. F-Secure blog, 05/13/2008.

Phishing botnet expands by hacking legit sites
A botnet is now using a SQL injection attack tool designed to hack legitimate Web sites, a move meant to add more hijacked PCs to its collection, according to a security researcher. Computerworld, 05/14/2008.

Hacker writes rootkit for Cisco's routers
A security researcher has developed malicious rootkit software for Cisco's routers, a development that has placed increasing scrutiny on the routers that carry the majority of the Internet's traffic. IDG News Service, 05/14/2008.

Fake Windows Update Popup: It's Back (Again)
The fake Windows Update popup has been doing the rounds on Myspace for a long time (we're talking at least June 2007). Every now and again it returns, usually varying the payload. Well, here we have an example where Phishing is involved and a sneaky imitation of a well known security program is thrown in for good measure. The SpywareGuide Greynets Blog, 05/14/2008.

Phishers scamming IRS rebates
Scammers want your IRS refund checks and have devised at least one phishing scheme to get it, according to the FBI. The e-mail, which purports to be from the IRS advises recipients that the best way to get their economic stimulus rebate money is by direct deposit. It then directs them to a Web site that asks them to enter bank account information and other personal data. Network World, 05/12/2008.
**********

From the interesting reading department:

Debian predictable PRNG fiasco
I am a big fan of Debian and Ubuntu- but not a big fan of gaping, ginormous security holes. The largely under-reported "predictable Pseudo Random Number Generator" OpenSSL vulnerability in Debian (and Ubuntu, and other Debian variants) leaves a gaping hole not only in those systems, but systems which are using keys from vulnerable systems. Uncommon Sense Security, 05/14/2008.

Whitepapers

• The Trend from UNIX to Linux in SAP(r) Data Centers
• Getting in Compliance With Government Data Regulations By Leveraging Online Security Technology
• How to Offer the Strongest SSL Encryption
• Maximizing Site Visitor Trust Using Extended Validation SSL
• Seven Steps to Reducing your Security Risk
• The Latest Advancements in SSL Technology

View more SECURITY whitepapers

Webcasts

• The Secure Web Gateway. Mission Critical For Business - Webcast
• Mobile Data Security
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• The self-managed network

View more SECURITY special reports