* Patches from Apple, Microsoft, Ubuntu, others * Tricky eBay car scam hits the Web * Phishing attacks target CareerBuilder.com users, and other interesting reading
Today’s bug patches and security alerts:
Apple patches multiple Mac OS X flaws
A new update from Apple fixes vulnerabilities in ColorSync, CoreGraphics, Crash Reporter, CUPS, Disk Images, DS Plug-Ins, Flash Player, GNU Tar, HFS, HID Family, ImageIO, Kernel, MySQL Server, Networking, OpenSSH, Printing, QuickDraw Manager, servermgrd, SMB File Server, Software Update, sudo, and Weblog.
Apple releases patch for iPhoto vulnerability
A flaw in Apple’s popular iPhoto application could exploited by an attacker to run malicious code on an affected system. The vulnerability lies in iPhoto’s handling of “photocasts”.
**********
Microsoft releases two Vista fixes
As promised, Microsoft did not unveil any security fixes Tuesday. But it did push out several other patches it deemed “high priority,” including two for Windows Vista. Among the four updates Microsoft pegged as “non-security, high-priority” today were the usual monthly revamp of the Microsoft Malicious Software Removal Tool and new signatures for the Outlook 2003 and Outlook 2007 antispam filters. Computerworld, 03/13/07.
New IE 7 bug could help phishers
A vulnerability in Microsoft’s Internet Explorer browser could help fraudsters make phishing Web sites appear legitimate, a security researcher reported Wednesday. Microsoft is investigating the claim. IDG News Service, 03/14/07
**********
Two new patches from Ubuntu:
Xine (buffer overflow, code execution)
**********
Two new updates from Mandriva:
xine-lib (buffer overflow, code execution)
mplayer (buffer overflow, code execution)
**********
Two new fixes from Gentoo:
SILC Server (denial of service)
**********
Today’s malware news:
Tricky eBay car scam hits the Web
Symantec has uncovered an unusually sophisticated e-mail scam, targeting eBay users with a combination of legitimate eBay auctions and a Windows Trojan that intercepts a user’s Web traffic. TechWorld, 03/12/07.
**********
From the interesting reading department:
Phishing attacks target CareerBuilder.com users
Attackers are launching targeted phishing scams from the job-related site CareerBuilder.com, according to one network manager who says his engineering firm recently had to combat phishing techniques that use the lure of phony online resumes. Network World, 03/12/07.
Hosting company hit by hack attack
E-mail hosting company Servers Australia was the victim of a hack attack on Friday which spammed its customers with offensive e-mails by assuming the company’s domain name. Computerworld, 03/12/07.
CEBIT – Grisoft releases small business security software
Grisoft rolled out two security products on Tuesday for small businesses that want simple management, the company said. One product, AVG Internet Security SBS edition, includes AVG Anti-Virus, Anti-Spyware and Anti-Spam plus a desktop firewall. It will run on desktop, laptops, file servers and e-mail servers, Grisoft said at the Cebit trade show in Hanover, Germany. IDG News Service, 03/13/07.
Trend Micro acquires HijackThis antispyware
Trend Micro Wednesday announced it has acquired the antispyware freeware tool HijackThis from its Netherlands-based creator, Merijn Bellekom, for an undisclosed price. Network World, 03/14/07.
