* Patches from Microsoft, Cisco, Ubuntu, others * Hackers launch massive IFRAME attack * Trend Micro hit by massive Web hack, and other interesting reading
For those that rely on Excel to supplement their math skills, watch out. One of last week’s security updates for the spreadsheet application caused a math bug. The flawed calculations should be obvious as all zeroes will be returned. Microsoft does have a workaround. And Cisco is out with a second patch in as many weeks, this time fixing a flaw in its CiscoWorks Internetwork Performance Monitor.
Buggy Microsoft Excel patch causes bad math
If you installed one of those Excel security patches issued by Microsoft earlier this week, you may want to double-check your math. That’s because a bug in the recent MS08-014 patch is causing Excel to return zeroes instead of the correct number when certain types of macros are run within the program. IDG News Service, 03/14/08.
**********
Cisco patches CiscoWorks Internetwork Performance Monitor
According to the Cisco advisory, “CiscoWorks Internetwork Performance Monitor (IPM) version 2.6 for Sun Solaris and Microsoft Windows operating systems contains a vulnerability that allows remote, unauthenticated users to execute arbitrary commands. There are no workarounds for this vulnerability.” A free update is available.
**********
Two new updates from Ubuntu:
mailman (multiple cross-scripting flaws)
**********
Two new patches from Mandriva:
gcc (directory traversal, file overwrite)
Pulseaudio (unauthorized access)
**********
Today’s malware news:
Hackers launch massive IFRAME attack
Hackers using a new scam continue to subvert hundreds of thousands of Web pages with IFRAME redirects that send unwary users to malware-spewing sites, researchers said today. Computerworld, 03/16/08.
Password-stealing hackers infect thousands of Web pages
Hackers looking to steal passwords used in popular online games have infected more than 10,000 Web pages in recent days. IDG News Service, 03/12/08.
**********
From the interesting reading department:
Trend Micro hit by massive Web hack
Security vendor Trend Micro has fallen victim to a widespread Web attack that splashed malicious software onto hundreds of legitimate Web sites in recent days. IDG News Service, 03/14/08.
Remote workers present ‘security risk,’ IT execs fear
IT executives fear there is a growing security risk from remote workers. But they are still coming under pressure to open corporate networks to remote workers and a range of external “outsiders,” a survey by policy networking software firm AEP Networks has revealed. Computerworld, 03/14/08.
RFID hack could crack open 2 billion smart cards
A student at the University of Virginia has discovered a way to break through the encryption code of RFID chips used in up to 2 billion smart cards used to open doors and board public transportation systems. Computerworld, 03/14/08.
Database expert: Oracle behind Microsoft on patch management
Oracle needs to improve patch management, an area where it’s currently lagging five years behind Microsoft, according to database expert Karel Miko at Czech consultancy DCIT. IDG News Service, 03/13/08.
‘Akill’ charged with University of Pennsylvania attack
Owen Walker, the 18-year-old alleged ring-leader of an international botnet coding group, has been charged with attacking the computer system of the University of Pennsylvania. Computerworld , 03/16/08.
King of Spam pleads guilty; faces 26 years in prison
The notorious spammer authorities dubbed “the King of Spam” is facing a possible 26-year jail sentence after pleading guilty in Seattle on Friday to charges of fraud and tax evasion.
We know that not all phishers have a Ph.D. in the art of phishing; therefore, you can sometimes find some interesting and funny pieces of code in phishing kits found on the Internet. As Easter is coming up soon, I decided to compile a top five list of the funniest Easter eggs that I have seen in phishing kits lately. Symantec Security Response blog, 03/14/08.
Harvard grad students hit in computer intrusion
Harvard University’s Graduate School of Arts and Sciences (GSAS) is notifying about 10,000 people that their personal information may have been compromised as a result of a computer intrusion that was discovered in February. Computerworld, 03/13/08.
