* Patches from Apple, Mozilla, Gentoo, others * Trojan lurks, waiting to steal admin passwords * Microsoft scrutinizes WSUS patch snafu, and other interesting reading
With a long holiday weekend upon us, it’s good time to take a look at the various browsers on your system and make sure they’re up to date. Why? According to one survey, 637 million users are running out-of-date browsers that put them at risk to malware and other threats. The timing is good as well since Mozilla just released a new Firefox 2 update that fixes a number of flaws and notes that it will end support for Version 2.0 sometime in December. Apple Mac OS X users also have 25 fixes to install this week. Happy 4th of July!
Apple patches 25 Mac OS X security vulnerabilities
Apple Tuesday issued its fourth security Mac OS X update of the year, patching 25 vulnerabilities, nearly half of them considered critical. The company also updated Safari for the Mac to plug a hole already fixed in the Windows version of the browser and released an update to bring the OS to version 10.5.4. Computerworld, 07/03/2008.
**********
Mozilla patches 13 bugs in Firefox 2
After patching its older Firefox 2.0 yesterday to quash 13 bugs, Mozilla Corp. announced that it would end support for the browser in mid-December. Firefox 2.0.0.15 addresses 13 vulnerabilities, five of which the open-source company rated “critical,” according to advisories posted on Mozilla’s site Tuesday. Of the remaining bugs, four were labeled “high,” two as “moderate,” and two as “low.” Computerworld, 07/02/2008.
After reading the highlights of this survey (“Study: Unpatched Web browsers prevalent on the Internet”), it’s important to update Firefox 2.0 browsers as soon as possible.
**********
Two new updates from Gentoo:
Python (multiple integer overflows, code execution)
Motion (multiple flaws, code execution)
**********
Two new fixes from rPath:
wireshark (denial of service, information disclosure)
mercurial (authenication bypass, file overwrite)
**********
Two new patches from Ubuntu:
**********
Today’s malware news:
Trojan lurks, waiting to steal admin passwords
The criminals behind the Coreflood Trojan are using the software to steal banking and brokerage account usernames and passwords. They’ve amassed a 50G-byte database of this information from the machines they’ve infected, according to Joe Stewart, director of malware research with security vendor SecureWorks. IDG News Service, 07/01/2008.
F-Secure warns against new, efficient malware
Watch out for the newest generation of malware that is difficult to crack and efficient, warns antivirus firm F-Secure. Computerworld, 07/01/2008.
**********
From the interesting reading department:
Clear Choice Test: Security management tools come up short
After 10 years on the market, products should be better at reporting, usability and advanced correlation features. Network World, 06/30/2008.
Microsoft scrutinizes WSUS patch snafu
Microsoft Monday confirmed it is investigating two-week-old reports from users unable to update client PCs using Windows Server Update Services (WSUS), but said that it is “premature” to assume the snafu had the same source as another patch glitch the company has grappled with since mid-June. Computerworld, 07/01/2008.
Unstructured data at risk in most firms, survey finds
Corporate information stored on file servers and network-attached storage (NAS) devices is in danger of compromise because IT governance policies and access rules in many companies are incapable of dealing with a massive growth of unstructured data, according to a Ponemon Institute report issued Tuesday. Computerworld, 07/01/2008.
How your cold explains network intrusion
With the cold an flu season most definitely upon us, there is much that the common cold can show us about network intrusion and what can happen once a single compromise has taken place. Computerworld, 07/01/2008.
Apple iPhone Four Months Behind OS X in Patches
Apple’s iPhone runs a miniature version of OS X, the operating system that powers Mac computers. So it’s fitting that Apple designed the iPhone to check for security updates whenever users fire up iTunes with their iPhone attached. Washington Post Security Fix, 07/02/2008.
Laptops lost like hot cakes at U.S. airports
Keep laptops close at airports, because they have a startling tendency to disappear in the blink of an eye, according to a new survey. IDG News Service, 06/30/2008.
Kaspersky adds anti-keylogger keyboard
The new version of Kaspersky’s security suite, Internet Security 2009, features a novel but simple defense against keylogging malware — a virtual keyboard. TechWorld, 07/01/2008.
