* Patches from Ubuntu, Debian, Gentoo, others * Microsoft: We took out Storm botnet * CNN site hit by China attack, and other interesting reading
Looks like Network World had its own bug to patch. A security researcher sent us a note detailing a cross-scripting exploit in the way our printer friendly system works – or should I say worked. We’ve fixed it, thankfully. Another “everyone needs to stay vigilant” lesson. Speaking of staying vigilant, Microsoft re-issued two patches this week to fix critical flaws found in recent updates.
Critical holes newly fixed for Internet Explorer and Windows
Microsoft has re-issued two patches. One patch, originally issued during the April Patch Tuesday, is rated critical and affects all recent version of Internet Explorer. The vulnerability is known as the “data stream handling memory corruption vulnerability.” It could enable remote code execution because of the way that IE processes data streams. If a user visits a Web page that exploits the vulnerability, it could allow the attacker to gain the same user rights as the logged-in user. Microsoft Subnet, 04/23/08.
Updated patch bulletins:
Vulnerabilities in .NET Framework Could Allow Remote Code Execution
Cumulative Security Update for Internet Explorer
**********
Asterisk patches critical flaw
A flaw in the way the Asterisk PBX handle certain handshake sequences could be exploited to hijack calls. A fix is available.
**********
Two new updates from Ubuntu:
Gnumeric (buffer overflow, code execution)
Firefox (javascript flaw, code execution)
**********
Three new patches from Debian:
iceweasel (javascript flaw, code execution)
**********
Four new fixes from Gentoo:
VLC (buffer overflow, code execution)
DBmail (information disclosure)
CUPS (integer overflow, code execution)
**********
Today’s malware news:
Microsoft: We took out Storm botnet
Microsoft today took credit for crushing the Storm botnet, saying that the malware search-and-destroy tool it distributes to Windows users disinfected so many bots that the hackers threw in the towel. Computerworld, 04/22/08.
Hackers jack thousands of sites, including UN domains
Large numbers of legitimate Web sites, including government sites in the U.K. and some operated by the United Nations, have been hacked and are serving up malware, a security researcher said today as massive JavaScript attacks last detected in March resume. Computerworld, 04/23/08.
**********
From interesting reading department:
FAQ: Windows XP SP3 ships – finally
Microsoft Monday finally slapped a “Done” sticker on Windows XP Service Pack 3 (SP3) and pushed it out the door. The designation of SP3 as RTM, for “release to manufacturing,” wasn’t much of a surprise, given how the company’s schedule leaked last week. Computerworld, 04/21/08.
PayPal denies plan to block Safari
PayPal has denied claims it plans to lock Safari users out of its online payments service as it reinforces its protections against online credit fraud. Mac World, 04/21/08.
Obama site hacked, redirects clicks to Clinton’s site
A cross-site scripting vulnerability in the social networking section of Sen. Barack Obama’s campaign site was exploited over the weekend to redirect users to the URL of rival Sen. Hillary Clinton (D-N.Y.), researchers claimed today. Computerworld, 04/21/08.
Mac hack contest bug had been public for a year
When Charlie Miller won $10,000 for hacking into a Macbook Air laptop last month, he exploited a flaw that had been publicly disclosed nearly a year before the contest. IDG News Service, 04/22/08.
CNN site hit by China attack CNN Attacks – Inside Two Dedicated DDoS Tools
After being called off Friday, the on-again, off-again cyberattack against CNN’s Web site again picked up steam early this week, according to network security analysts. IDG News Service, 04/23/08.
Security to the Core blog:
Reverse-Engineering Exploits from Patches
This is interesting research: given a security patch, can you automatically reverse-engineer the security vulnerability that is being patched and create exploit code to exploit it? Turns out you can. Schneier on Security, 04/23/08.
I came across a number of Web sites hacked over the last few weeks using an SQL injection – the same exploit used by script-kiddie tearway The Punisher. I quickly realised this person was hanging out on the same forums as our Punishing pal, and quickly traced him back to his main Web site. The SpywareGuide Greynets Blog, 04/23/08.
LendingTree discloses insider data breach
Web-based lending exchange LendingTree, which generates leads in the mortgage business by accepting online customer information, disclosed Monday that it believes several former employees illicitly helped a handful of mortgage lenders gain access to customer data. Network World, 04/22/08.
Microsoft credits researchers for hacking
Security researchers are free to investigate Microsoft’s online services for security bugs, without fear of prosecution – as long as they submit the bugs they find “responsibly” to Microsoft, the company said this week. TechWorld, 04/22/08.
