* Patches from Microsoft, Ubuntu, Mandriva, others * Trojan impersonates Windows activation to snatch data * New bug-a-day project targets Microsoft's ActiveX, and other interesting reading
Today’s bug patches and security alerts:
Microsoft: Seven patches coming this week
Two of the seven bulletins slated for the May 8 release involve Windows, three affect Microsoft Office, and one each impact Microsoft Exchange and the cryptography API within BizTalk Server. At least five of the seven updates will be pegged critical, Microsoft’s highest threat score in its four-level system, according to the advance notification posted Thursday. Computerworld, 05/03/07.
Also: Microsoft promises DNS patch Tuesday
**********
Montage update fixes bugs
Mariner Software on Wednesday released Montage 1.2.2, a free update to their screenwriting software for Mac OS X. MacWorld, 05/02/07.
**********
A flaw in the way Ubuntu’s net-snmp handles certain TCP packets could be exploited by an attacker in a denial of service attack against an affected system. An update is available.
**********
A flaw in the xscreensaver could be exploited by an attacker to crash an affected system’s network connection and bypass xscreensaver’s authentication system. An update is available.
**********
Five new updates from rPath:
xscreensaver (authentication bypass)
**********
Malware news of the day:
Trojan impersonates Windows activation to snatch data
Symantec researchers Friday warned of an in-the-wild Trojan horse that poses as a Windows activation program to dupe users into entering credit card information in an attempt to reanimate their machines. Computerworld, 05/04/07.
**********
From the interesting reading department:
New bug-a-day project targets Microsoft’s ActiveX
Another bug-a-day campaign surfaced Tuesday as the “Month of ActiveX Bugs” debuted. Although some researchers have already dismissed the project as copycat, others are warning its findings might put Windows users at risk of attack. Computerworld, 05/02/07.
Microsoft rolls out client-based spyware tool
Forefront Client Security is a time saver for busy administrators, but may not be a definitive answer for enterprise malware protection. Network World, 05/05/07.
Reading LCD Displays at a Distance
We all know that CRT displays radiate like mad, and someone with the right equipment can read them at a distance. Marcus Kuhn demonstrates how to do the same thing with LCD displays. Schneier on Security blog, 05/04/07.
