* Patches from Microsoft, Apple, Google, others * Infection Links target Orkut Users On Twitter * Flawed Trend Micro antivirus update cripples PCs , and other interesting reading
Big names rolled out patches this week: Microsoft, Apple and Google, along with updates for Mandriva, Gentoo and Ubuntu. Microsoft’s Patch Tuesday is only (only!) four critical patches, but touches some 42 different products/versions, making life difficult for those ensuring all systems are up-to-date. Google’s Chrome update is interesting too because users must manually get the update, unlike competitor Firefox that automatically rolls out fixes to users. Finally, I did promise some DEMO coverage today, but will push that off until Monday. The 72 companies are all melded in my mind and I need to sort them out.
Microsoft patches will put IT on hunt for affected systems
Microsoft Tuesday released four critical patches targeting vulnerabilities mostly in Windows-based server and client operating systems, including one that affected 42 versions of various Microsoft software products. Network World, 09/09/2008.
Microsoft patch wrap-up advisory
**********
Apple releases four new upgrades that feature security fixes
At Apple’s much-hyped (though somewhat underwhelming) launch event on Tuesday, the company rolled out a number of product updates that also fix some serious security issues. Chief among the fixes is a new update for iPhone (ver 2.1) and update for QuickTime that patches a vulnerability that could have been exploited to run malicious code.
Apple advisories:
**********
Critical vulnerability patched in Google’s ChromeA Vietnamese security company has found a critical vulnerability in Google’s new browser Chrome, but Google has already released patch for that problem and at least one more. Users should upgrade to version 0.2.149.29 via the “Check for Updates” menu option. IDG News Service, 09/08/2008.
**********
Three new updates from Gentoo:
Amarok (temp file vulnerability)
VLC (multiple flaws)**********
Two new patches from Mandriva:
ClamAV (multiple flaws)**********
Two new fixes from Ubuntu:
Racoon (memory leak, denial of service)
libxml2 (denial of service)**********
Today’s malware news:
What’s The Latest Buzz?The 2008 US Presidential Election is well on its way, and what news could be more enticing than an alleged sex scandal involving one of the candidates? The latest e-mail spam run on the loose contains a link to an supposed pornographic video of Democratic candidate Senator Barack Obama. F-Secure, 09/10/2008.Infection Links target Orkut Users On TwitterOrkut has long been a popular target for hackers, and we’ve come across evidence of Orkut users being targeted via Twitter pages carrying infection links. The SpywareGuide Greynets Blog, 09/08/2008.
**********
From the interesting reading department:
Flawed Trend Micro antivirus update cripples PCsAntivirus updates issued by Trend Micro Inc. on Friday crippled Windows XP and Vista PCs when they mistook several critical system files for malware, and blocked access to those files. Computerworld, 09/09/2008.San Francisco hunts for mystery device on city networkWith costs related to a rogue network administrator’s hijacking of the city’s network now estimated at US$1 million, city officials say they are searching for a mysterious networking device hidden somewhere on the network. IDG News Service, 09/10/2008.$10M in 10 Minutes? – Security Implications of UAL Bankruptcy SnafuUnless you’re living under a rock, it’s likely you’ve already shaken your head at least once today at the impact an archived, 6 year old newspaper article had on United Airline’s (UAUA) stock today. If you are living under a rock, then read this. Security to the Core blog, 09/08/2008.Beware of UC security threatsUnified communications opens up your VoIP network new avenues of collaboration, including instant messaging, video, business applications and e-mail. And that opens up your network to new avenues of attack. Network World, 09/08/2008.Too many passwords or not enough brain power?Our brains are littered with passwords and alphanumeric combinations that span all levels of necessary corporate and personal security – from bank accounts and PINs, to work-related e-mail and network log-ons, to e-commerce and social networking sites. CIO, 09/08/2008.
