* Patches from Gentoo, Mandriva, Debian * Rootkits outfox old-school malware protection * Blogger posts Windows Vista SP1 fixes on Web site, and other interesting reading
Today’s bug patches and security alerts:
Microsoft issues emergency Windows patch
With attackers finding more ways to exploit a critical flaw in its Windows operating system, Microsoft has published an emergency software patch. The update, released as expected Tuesday morning, fixes seven separate Windows vulnerabilities, but security experts are most concerned about a bug in the way Windows processes .ani Animated Cursor files. Online criminals have been exploiting this bug since late last week. IDG News Service, 04/03/07.
Microsoft’s new patch causing issues for XP users
Just one day after releasing an emergency patch for a vulnerability in its operating system, Microsoft has documented one problem with it and is asking users to report any other issues they might encounter. Network World, 04/04/07.
Related Microsoft Knowledgebase article
**********
US-CERT warns of flaws in MIT Kerberos 5
According to the US-CERT advisory, “The MIT Kerberos 5 implementation contains several vulnerabilities. One of these vulnerabilities could allow a remote, unauthenticated attacker to log in via telnet (23/tcp) with elevated privileges. The other vulnerabilities could allow a remote, authenticated attacker to execute arbitrary code on a Key Distribution Center (KDC).
Related updates:
**********
Five new patches from Gentoo:
OpenAFS (privilege escalation)
zziplib (buffer overflow, code execution)
**********
Four new fixes from Mandriva:
**********
Three new updates from Debian:
file (buffer overflow, code execution)
zope 2.7 (cross scripting, code execution)
**********
Five new patches from rPath
firefox (information disclosure)
**********
Today’s virus and malware news:
Rootkits outfox old-school malware protection
Security experts now believe that Trojan, spam and malware protection software cannot adequately prevent system compromise by increasingly sophisticated rootkits. Computerworld, 03/30/07.
**********
From the interesting reading department:
Blogger posts Windows Vista SP1 fixes on Web site
The owner of a blog dedicated to software patches has posted online more than 100 fixes he said are expected to be included in Windows Vista Service Pack 1, Microsoft’s first major update to its latest Windows client OS. IDG News Service, 04/02/07.
Vendor aims to ‘cloak’ WEP
New software from AirDefense is designed to protect a widely used but flawed wireless LAN encryption protocol. The software “cloaks” the encryption key used to scramble WLAN data packets by means of the Wired Equivalent Privacy protocol. Network World, 04/02/07.
Pill spammers turn hackers to ‘joe job’ sites
Spammers are hacking into legitimate Web sites through unpatched vulnerabilities in the PHP scripting language to sidestep blacklists that block spam or bar access to known spammer sales sites, a security company said Thursday. Computerworld, 03/30/07.
