* Patches from Oracle, rPath, Mandriva, others * Latest malware threat * The 7 best practices for network security in 2007, and other interesting reading
Today’s bug patches and security alerts:
The latest round of Oracle patches are out and impact a number of products. The January 2007 release contains 17 fixes for Oracle Database, 9 for its HTTP Server, 12 for the Application Server, 7 for the E-Business Suite, 6 for Enterprise Manager and 3 for the PeopleSoft Enterprise People Tools.
**********
Three new updates from rPath:
gd (multiple denial of service flaws)
kdenetwork (man-in-the-middle attack)
**********
Four new patches from Mandriva:
fetchmail (passwords sent in cleartext)
cacti (SQL injection, code execution)
bluez-utils (remote control of system)
**********
Four new fixes from Gentoo:
**********
Latest malware threat:
The Warezov gang is using variants of Warezov and Medbot/Horst to send out medication and replica spam. The Rustock gang is using Mailbot.AZ and variants to send out stock spam. The Warezov gang is apparently operating from China and the Rustock boys from Russia. F-Secure Weblog, 1/18/07.
**********
From the interesting reading department:
The 7 best practices for network security in 2007
We all face it – the daily barrage of spam, now infested with zero-day malware attacks, not to mention the risks of malicious insiders, infected laptops coming and going behind our deep packet-inspecting firewalls and intrusion-prevention systems. Some even have to worry about how to prove steps of due care and due diligence towards a growing roster of regulatory compliance pressures. Network World, 01/17/07.
Symantec to use SONAR to find zero-day attacks
Starting next month, users of Symantec’s Norton products will have a new tool to help them avoid unpatched software flaws. IDG News Service, 01/16/07.
Start-up Veracode offers code security evaluation online
Start-up Veracode next month will begin offering a software code evaluation service online that will allow businesses to upload their code for a security review and receive it back with suggested corrections the next day. Network World, 01/16/07.
SurfControl speeds delivery of threat info
SurfControl on Tuesday announced plans to boost delivery of its Internet security threat lists by making them available on Akamai’s network of 20,000 servers. Network World, 01/17/07.
