* Patches from Gentoo, Mandriva, Debian, others * Top 10 virus infections for the past 7 days, as reported by Trend Micro * Check Point hopes to buy mobile security specialist Pointsec, and other interesting reading
Today’s bug patches and security alerts:
Firefox vulnerable to password-stealing attack
A flaw in Mozilla’s Firefox browser makes it easy for cybercriminals to steal user information on Web sites where users create their own pages, such as MySpace.com. The flaw lies in Firefox’s Password Manager software, which can be tricked into sending password information to an attacker’s Web site, said Robert Chapin, president of Chapin Information Services Inc. For this attack to work, attackers need to be able to create HTML forms on the Web site, something that is allowed on blogging and social networking sites. IDG News Service, 11/22/06.
Robert Chapin’s analysis of the flaw
**********
Ten patches for Gentoo:
TORQUE (code execution, privilege escalation)
qmailAdmin (buffer overflow, code execution)
Texinfo (buffer overflow, code execution)
fvwm (local command execution)
ImageMagick (improper data handling)
GNU gv (stack overflow, code execution)
**********
Four updates for Mandriva:
apache-mod_auth_kerb (heap overflow, denial of service)
**********
Half-dozen patches from Debian:
gv (buffer overflow, code execution)
flexbackup (denial of service)
linux-ftpd (restriction bypass)
**********
Four patches from Ubuntu
**********
Top 10 virus infections for the past 7 days, as reported by Trend Micro:
1. Troj_Generic (20,740)
2. Worm_Nyxem.E (10,220)
3. Html_Netsky.P (8,207)
4. Worm_Netsky.Dam (7,739)
5. Adw_Websearch.K (7,533)
6. Pe_Parite.A (4,928)
7. Worm_Rontkbr.Gen (4,674)
8. Pak_Generic.001 (4,570)
9. Worm_Anig.A (4,448)
10. Worm_Generic (2,821)
**********
From the interesting reading department:
Check Point hopes to buy mobile security specialist Pointsec
Check Point plans to expand the scope of its security products by adding data encryption for mobile devices, technology it will acquire from Pointsec Mobile Technologies if a bid offered next week is accepted. Network World, 11/21/06.
Oakley rolls out laptop protection software
Oakley Networks this week rolled out software that lets organizations remotely locate a lost or stolen laptop, determine whether data on the laptop has been compromised, and destroy the data to protect it from exposure. Network World, 11/21/06.
