* Patches from Cisco, Ubuntu, Debian, others * Old worm Slammer threatens again * 10 pieces of lousy security advice, and other interesting reading
Today’s bug patches and security alerts:
Cisco patches CallManager/Unified Communications Manager
According to the Cisco advisory, “Cisco CallManager and Unified Communications Manager are vulnerable to cross-site Scripting (XSS) and SQL Injection attacks in the lang variable of the admin and user logon pages. A successful attack may allow an attacker to run JavaScript on computer systems connecting to CallManager or Unified Communications Manager servers, and has the potential to disclose information within the database.” A free update is available.
**********
Apple updates AirPort Extreme Base Station
A flaw in the way Apple’s AirPort Extreme Base Station wireless router handles certain IPv6 packets has been fixed in a new update from the company. Older versions of the software could be exploited to limit bandwidth on an affected network. Users should upgrade to firmware Version 7.2.1.
**********
Four new patches from Ubuntu:
Vim (input sanitization, code execution)
**********
Five new updates from Debian:
postfix-policyd (buffer overflow, code execution)
rsync (buffer overflow, code execution)
**********
Two new fixes from Mandriva:
**********
Today’s malware news:
Old worm Slammer threatens again
An old worm known as Slammer, which originated back in January 2003, is still going strong according to Gunter Ollmann, director of security strategy at IBM’s Internet Security Systems. TechWorld, 08/24/07.
UN serves keylogger, Trojan after online attack
The United Nations (UN) is the latest victim in a string of hacking attacks aimed at identity and credit card theft, and building botnet hordes. The attack on the UN Asia Pacific Web site is believed to originate from the same group responsible for attacks on the U.S.-based Biotechnology Information Organization and the prominent Indian Syndicate Bank. Computerworld, 08/28/07.
PDF spam levels plummet
Having reached its peak volume on Aug. 7 at nearly 30 % of all spam messages sent, PDF spam today is hardly registering on e-mail security vendors’ spamometers. Network World, 08/29/07.
IM threats double in August
In the month of August to date, there have been 38 malicious-code attacks on instant-messaging networks, double the number experienced in July. Network World, 08/29/07.
‘Storm’ Trojan horse taps into YouTube fever
Hackers bent on spreading the Storm Trojan horse have changed tactics again and are now trying to dupe users into clicking on links posing as YouTube videos, security vendors warn. Computerworld, 08/27/07.
Deja vu: Sony uses rootkits, charges F-Secure
A line of USB drives sold by Sony Electronics installs files in a hidden folder that can be accessed and used by hackers, a Finnish security company charged Monday, raising the specter of a replay of the fiasco that hit Sony’s music arm two years ago when researchers discovered that its copy protection software used rootkit-like technologies. Computerworld, 08/27/07.
[F-Secure: Sony’s USB Rootkit vs Sony’s Music Rootkit]
IRS warns of new phishing scam
The Internal Revenue Service today warned taxpayers of a new phishing scam where an e-mail purporting to come from the IRS advises taxpayers they can receive $80 by filling out an online customer satisfaction survey. Network World, 08/28/07.
**********
From the interesting reading department:
Canonical downplays Ubuntu hacks
Canonical Ltd., the commercial sponsor of the Ubuntu Linux, said that recent compromises of most of its local community servers do not reflect on the distribution’s security or corporate-readiness. TechWorld, 08/28/07.
The Monster.com mess
The last thing you need when you’re unemployed is a bank account that’s suddenly emptied. But that’s exactly what some unwary users of employment search site Monster.com faced after identity thieves made off with the personal information of more than a million people looking for jobs. Computerworld, 08/28/07.
Monster outlines antifraud measures
One week after hackers stole personal information from millions of people who had posted their resumes to the job-searching site Monster.com, the company has warned its users to be vigilant about online fraud because the breach was not an isolated incident. IDG News Service, 08/29/07.
You don’t want to hear it: 10 pieces of lousy security advice
Sometimes a few words from a software vendor, potential partner or consulting security expert tell you everything you need to know about whose advice is worthwhile — when it’s best to smile and nod, or whether you need to interrupt and challenge someone who’s seriously off the rails. Here are 10 telltale phrases that signal troublesome advice. Computerworld, 08/27/07.
