* Patches from Microsoft, Gentoo, rPath, others * Top virus threats, according to Grisoft * Sophos targets SMBs with integrated security suite, and other interesting reading
Today’s bug patches and security alerts:
After patches, Microsoft warns of PowerPoint attack
Just days after patching four bugs in PowerPoint, Microsoft is warning of a new attack targeting its presentation software. “We’ve been made aware of proof of concept code published publicly affecting Microsoft Office 2003 PowerPoint,” wrote Microsoft Security Program Manager Alexandra Huft in a Thursday blog posting. “The reported proof of concept may allow an attacker to execute code on a user’s machine by convincing them to open a specially-crafted PowerPoint file.” IDG News Service, 10/13/06.
**********
Cisco warns of default password Wireless Location Appliance
According to a Cisco advisory, “The Cisco Wireless Location Appliance software contains a default password for the ‘root’ administrative account. A user who logs in using this username has complete control of the device.” Workarounds are available.
**********
Two flaws in the Python implementation for rPath could be exploited in a denial-of-service attack or to potentially gain elevated privileges on an affected machine.
**********
Two flaws in the FreeBSD OpenSSH implementation could be exploited to run malicious code or cause a denial of service. A patch is available.
**********
Gentoo releases fix for nCompress
A buffer underflow flaw in nCompress could be exploited to run malicious code on an affected system. Gentoo has released a patch.
**********
Top virus threats, according to Grisoft:
BackDoor.Generic3.GBB and .GBC
Exploit.WMF
I-Worm/Bagle.JH
I-Worm/Sober.CF
I-Worm/Sober.S, .T
I-Worm/Mytob.LY, LZ (aka Zotob.A – B)
**********
From the interesting reading department:
Study: ‘Net infrastructure undermined by DNS errors
More than half the name servers on the Internet are configured wrongly, leaving networks open to attacks, a security company has warned. Domain name servers, which everyone running an enterprise network must have, are often configured in ways which can cause harm to the company, or to other Internet users. TechWorld, 10/11/06.
Oracle simplifies its patch process
Oracle has taken steps to make its next batch of security patches a little bit easier to understand. With the October Critical Patch Update, due out Tuesday, Oracle will begin rating vulnerabilities according to the Common Vulnerability Scoring System, a system backed by Cisco and IBM that attempts to standardize the way security flaws are rated. IDG News Service, 10/11/06.
Who needs Symantec and McAfee? Crime dog McGruff is on the network security job
McGruff is sick of Americans dogging it on cybercrime. The tough-talking crime dog, who has been used to fight more traditional varieties of unlawfulness over the last 26 years (that’s 117 dog years), is at the heart of a new National Crime Prevention Council effort to get people “to protect their digital assets and real-world identities” by getting smarter about cyberspace. Network World, 10/12/06.
Sophos targets SMBs with integrated security suite
Sophos this week announced an integrated suite of security products aimed to help SMBs better protect themselves from malicious attacks. Called the Sophos Security Suite and available now, the product is designed for both Windows and Macintosh PCs and caters to organizations with little or no dedicated IT staff, according to company officials. Network World, 10/13/06.
BT fires back at spammers
BT has launched an automated system to identify professional spammers and ‘botnet’-infected customers on the BT broadband network. TechWorld, 10/13/06.
Microsoft security chief Fathi is moved out
Just seven months after being named as Microsoft’s security czar Ben Fathi has set his sights on a new job. Starting in the next few weeks, Fathi will head up development of the core components of the Windows operating system, and the Security Technology Unit that he runs will be absorbed into the company’s Trustworthy Computing team, led by Scott Charney. IDG News Service, 10/12/06.
Vista’s DRM features could bedevil antivirus
A security researcher is raising concerns about a digital rights management feature in Microsoft’s new Vista operating system that he claims may make it easy for malicious code authors to block virus programs from removing their wares. InfoWorld, 10/12/06.
Geek speak bridles information security
Usability of security software is partly to blame for low protection levels in many computers, according to international security experts. Computerworld, 10/11/06.
