* Patches from Microsoft, Cisco, Mandriva, others * New smartphone Trojan has a profit motive * Microsoft launches last-ditch defenses against Office exploits, and other interesting reading
Today’s bug patches and security alerts:
Microsoft plugs critical Vista hole
Microsoft has just patched another critical hole in Vista that it knew about as long ago as last Christmas. The delay was similar to its lag in patching the serious (and heavily targeted) animated-cursor flaw reported last month. PC World, 05/21/07.
Microsoft advisory: Vulnerabilities in CSRSS Could Allow Remote Code Execution
**********
Cisco patches flaw in Crypto Library
A flaw in a third-party cryptographic library used by certain Cisco products could be exploited in denial-of-service attacks. Vulnerable products include Cisco IOS, Cisco IOS XR, Cisco PIX and ASA Security Appliances, Cisco Firewall Service Module (FWSM), and Cisco Unified CallManager. An update is available to fix the flaw.
Cisco reports multiple flaws in Cisco IOS
According to a Cisco advisory, “Cisco IOS device may crash while processing malformed Secure Sockets Layer (SSL) packets. In order to trigger these vulnerabilities, a malicious client must send malformed packets during the SSL protocol exchange with the vulnerable device.” A free update is available.
**********
Two new updates from Mandriva:
gimp (stack overflow, code execution)
Evolution (authentication bypass)
**********
Three new fixes from Debian:
**********
Four new patches from Ubuntu:
**********
Today’s malware news:
New smartphone Trojan has a profit motive
Antivirus researchers have turned up three Trojan horse variants that are the most successful attempts yet to steal money from smartphone users. The variants on the Viver Trojan (short for Trojan-SMS.SymbOS.Viver) send text messages to premium-rate numbers in Russia, a tactic used by some previous malware. But Viver is more sophisticated, according to Kaspersky Lab, which discovered all three Trojan variants last week. Computerworld, 05/22/07.
**********
From the interesting reading department:
Microsoft launches last-ditch defenses against Office exploits
Tacitly acknowledging that it cannot completely secure its Office suite against attackers, Microsoft Corp. yesterday promoted a last-ditch defense that lets administrators block users from opening documents. Computerworld, 05/22/07.
CSOs lasting longer, but still out after three years
The life span of corporate CSOs is increasing, with the average stay about 36 months, up from 24 months just a few years ago, attendees of CSO Bootcamp at Interop Las Vegas were told this week. Network World, 05/23/07.
CSOs need to be legal eagles
Chief security officers need to comb through the wording of the governmental and industry security regulations their businesses must comply with if they want to secure their networks and stay out of legal trouble. Network World, 05/23/07.
If it can protect bombs, why not commercial software, too?
A technology used by the U.S. Department of Defense to protect software from piracy and tampering has been released to the commercial sector to help software companies avoid loss of intellectual property, the makers of the product announced Monday. Network World, 05/21/07.
Cisco agrees to buy BroadWare for video security
Cisco announced an agreement to buy software maker BroadWare Technologies in a bid to improve its video surveillance product offerings, the company said. IDG News Service, 05/22/07.
