* Patches from Microsoft, Debian, Ubuntu, others * Sophisticated cyberattack on national labs under way, Oak Ridge says, and other interesting reading
Microsoft’s Patch Tuesday for December is this week and the focus seems to me on Media formats. In a preview of the coming updates, Microsoft said DirectX and the Windows Media Format Runtime will be targeted for patching. Also today, patches from Debian, Ubuntu, rPath and Mandriva.
Media formats to be the focus of upcoming Microsoft patches
Microsoft will issue seven security updates next Tuesday, including critical sets of patches for Windows and Internet Explorer. The three critical updates are all for Windows components, Microsoft said in a note on the upcoming release. These components include Internet Explorer, the DirectX and DirectShow graphics software, and the Windows Media Format Runtime, which is used by Windows Media Player. IDG News Service, 12/06/07.
Researchers hack and crack Microsoft wireless keyboards
Weak encryption used by Microsoft’s wireless keyboards can be cracked in a matter of moments, a pair of Swiss security researchers said today, giving hackers a way to snatch passwords and financial account information in real-time and from a distance.
Read the white paper (PDF)
**********
Five new updates from Debian:
e2fsprogs (integer overflow, code execution)
**********
Two new patches from Ubuntu:
e2fsprogs (integer overflow, code execution)
**********
Two new fixes from rPath:
**********
Three new patches from Mandriva:
libnfsidmap (privilege escalation)
liblcms (buffer overflow, code execution)
From the interesting reading department:
Sophisticated cyberattack on national labs under way, Oak Ridge says
The U.S. science and technology lab Oak Ridge National Laboratory yesterday disclosed it has been compromised by what it described as a “sophisticated cyber attack that appears to be part of a coordinated attempt to gain access to computer networks at numerous laboratories and other institutions across the country.” Network World, 12/07/07.
Cookie variants can skirt blockers, antispyware tools
Just because your Web browser is set to block third-party tracking cookies that doesn’t mean all of them are being blocked. Computerworld, 12/06/07.
Microsoft Vista’s IPv6 raises new security concerns
Members of the Internet engineering community have raised several new security concerns about Teredo, a mechanism for sending IPv6 traffic over IPv4 networks that comes turned on by default in Microsoft’s Vista software. Network World, 12/06/07.
ITIL takes on security management role
Long touted for streamlining processes and reducing operating costs, the ITIL best-practices framework also helps mitigate enterprise risk, say its adopters. Network World, 12/06/07.
Cisco spins out another corporate security architecture
Cisco this week rolled out yet another method for securing corporate networks. Called TrustSec, the architecture is intended to determine, through policies, the role of users and devices in the network before granting access to resources. This has been practiced in applications for years, Cisco officials say, but is only now being enforced at the network level. Network World, 12/05/07.
‘Zombie’ exploits cached by search engines
Over a year after first coming to light, the cache engines of major search engines are still providing a safe hiding place for malicious code, a security company has revealed. TechWorld, 12/07/07.
Glory hunter hacks MySpace pages of Timberlake, Hilary Duff
Several celebrity MySpace.com sites were defaced Wednesday by someone hoping to impress a hacker crew, a security researcher said today, a motivation of yore that harks back to when hackers sought notoriety rather than credit card numbers. Computerworld, 12/07/07.
Google disables Gmail accounts by mistake
Google this week mistakenly disabled the Gmail accounts of an undetermined number of users due to an apparently overzealous attempt by the company to combat spammers. IDG News Service, 12/07/07.
