* Patches from Apple, Ubuntu, Gentoo, others * MSN Worm Speaking in Tongues * Security flap: 'Responsible disclosure' debate flares anew, and other interesting reading
Your help needed: Collaboration tools survey
Wainhouse Research is conducting its annual survey on unified communications, collaboration, and videoconferencing. If you’re a user of such services and want to share your thoughts, you could win a $50 Amazon gift certificate.
Today’s bug patches and security alerts:
Google Desktop vulnerable to new attack
Just one day after a security researcher showed how Google’s Firefox toolbar could be exploited in an online attack, a similar flaw has been discovered in the Google Desktop. IDG News Service, 05/31/07.
Proof of concept: Google Desktop 0day
**********
Apple updates Xserve Lights-Out Management Firmware
According to an advisory from Apple: “A security vulnerability in Apple’s implementation of IPMI may allow an unprivileged user to gain administrative privileges on an Xserve system. This update addresses the issue by requiring a password for remote usage of IPMI”. Users should download Firmware Update 1.0 to fix the problem.
**********
Four updates from Ubuntu:
Gimp (file handling, code execution)
**********
Three updates from Gentoo:
File (integer overflow, code execution)
**********
Today’s malware news:
Last week saw the release of the Spanish Instant Messaging Worm W32.Posse. This week we have seen a similar Instant Messaging worm but this time it can use messages in Spanish, German, Dutch, Italian, French and English. Security Response Weblog, 06/01/07.
Calculating the Risk of Infection
A new virus has appeared for a new platform. Nothing really new about that, except that this time, the platform is a … calculator. Yes, the Texas Instruments TI89 is now the target of infection. The TI calculators are very powerful, and allow modules to be installed in the RAM. There are thousands of applications already, lots of games, hacks to display grayscale instead of just black and white, and of course lots of mathematics routines. Security Response Weblog, 05/31/07.
E-mail scammers hiding malware in fake IRS notices
If you get an e-mail telling you that you’re under investigation by the U.S. Internal Revenue Service, take a breath before calling your lawyer. It’s a scam. IDG News Service, 05/31/07.
**********
From the interesting reading department:
Security flap: ‘Responsible disclosure’ debate flares anew
When a recent hacking contest won security researcher Dino Dai Zovi a $10,000 award for breaking into a MacBook Pro computer by exploiting a flaw he’d discovered, the contest reignited a long-simmering debate over “responsible disclosure” of vulnerabilities. Network World, 05/31/07.
AV, how cam’st thou in this pickle
Dan McPherson is pleased with some of his colleagues at Arbor, with some co-collaborators at the University of Michigan, published the paper: Automated Classification and Analysis of Internet Malware (pdf). “The authors go on to demonstrate how what something does is more important then what you call it (i.e., behaviors are better than labels).”
iTunes DRM-free music still has Big Brother aspect
Apple finally began selling DRM-free music this week as part of its iTunes Plus service. For $1.29, you can get a track free of DRM restrictions and encoded at a higher bitrate. But there does seem to be a catch… Network World, 05/31/07.
