* Patches from Mandriva, Gentoo, rPath, others * Motorola Razr Vulnerability * Six hours to hack the FBI (and other pen-testing adventures), and other interesting reading
A lot of back and forth this week over an alleged new exploit in the wild that’s affecting Adobe’s Flash Player. Earlier this week, Symantec claimed there was a new exploit, but is now backing off that claim. Meanwhile, F-Secure says there is a SQL injection exploit out targeting a flaw in Flash that was reported earlier this month. On top of that, Apple’s out with 68 fixes for Leopard and Cisco’s got a patch that impacts many of its unifed communicaitons products.
There’s been some debate about the seriousness of an exploit and flaw found in Adobe’s Flash player. F-Secure is reporting there is a SQL injection attack in the wild exploiting a flaw found earlier this month, while Symantec is backing off claims of a newer exploit. Either way, stay tuned for an update from Adobe to Flash Player.
Symantec backtracks on Adobe Flash warning
**********
Apple updates Leopard, issues 68 fixes
More than three months after it last updated Mac OS X, Apple Inc. today released 10.5.3, an upgrade for its Leopard operating system that boasts nearly 70 stability, compatibility and security improvements and fixes. Apple did not include patches for two of three iCal vulnerabilities that were made public a week ago, however. Computerworld, 05/28/2008.
**********
Cisco patches CiscoWorks Common Services
A flaw in the CiscoWorks Common Services, found in many of the company’s unified communication products, is vulnerable to a flaw that can be exploited by remote attackers to run malicious code. A free update is available.
**********
Mozilla makes Firefox 3.0 bug-fix decision
Mozilla decided Tuesday to roll out a second release candidate for Firefox 3.0 that will include fixes for about 40 bugs. The alternative was to declare the open-source browser good “as is,” then patch the problems with a later update. Computerworld, 05/27/2008.
**********
Two new fixes from Mandriva:
OpenSSL (multiple flaws in key generation)
gnutls (denial of service, code execution)
**********
Three new patches from rPath:
emacs (malicious code execution)
evolution (format string code execution)
**********
Two new updates from Gentoo:
GnuTLS (denial of service, code execution)
**********
Today’s malware news:
TippingPoint has reported a JPEG Processing Stack Overflow Vulnerability affecting firmware based Motorola Razr phones. The vulnerability was discovered last summer. New Razr shipments will not be affected as Motorola has produced a fix for the issue. The vulnerability allows remote attackers to execute arbitrary code on vulnerable Motorola Razr firmware based cell phones. 05/28/2008.
You’ve seen it a thousand times before in malware infections. A Trojan Downloader that installs another Trojan Downloader which installs blah blah blah until you have a Russian Doll scenario. By the time you notice your being attacked, its probably already too late. The trojan in question here is called Trojan.Bind. The SpywareGuide Greynets Blog, 05/28/2008.
“Dear Google AdWords Customer”
Sometimes it can be quite hard to spot a phishing site on the first glance. F-Secure, 05/27/2008.
Romanian Whack-A-Mole and Linux Bots
It doesn’t always have to be the latest and greatest zero-day exploit that causes you to lose control of your computer or server to external attackers. Today’s example comes in the relatively ancient form of brute force SSH. F-Secure, 05/27/2008.
GTA IV, bait to distribute malware
PandaLabs has detected the Bck/VB.ABN malware that spreads through P2P networks, passing itself off as a music download of the popular “Grand Theft Auto IV” videogame. PandaLabs Oxygen3, 05/23/2008.
**********
From the interesting reading department:
Six hours to hack the FBI (and other pen-testing adventures)
It takes a lot to shock Chris Goggans; he’s been a pen (penetration) tester since 1991, getting paid to break into a wide variety of networks. But he says nothing was as egregious as security lapses in both infrastructure design and patch management at a civilian government agency — holes that let him hack his way through to a major FBI crime database within a mere six hours. Computerworld, 05/27/2008.
Less is more (secure)
Complexity is the enemy of security. Simple systems are inherently more secure than complex solutions. We see this idea validated again and again in security. Network World, 05/27/2008.
