* Patches from Apple, rPath, Ubuntu, others * Virus and malware news of the day * Daylight Saving changes: No Y2K, but there could be headaches, and other interesting reading
Today’s bug patches and security alerts:
Symantec warns of new zero-day Word attack
Hackers are exploiting a new, unpatched vulnerability in Microsoft Word that could allow them to take control of a victim’s computer, Symantec has warned. IDG News Service, 01/26/07.
**********
Apple releases AirPort Extreme patch
A flaw in Apple’s wireless LAN implementation could be exploited to crash a system by an attacker in close proximity. Apple says this affects Core Duo version of Mac mini, MacBook, and MacBook Pro computers equipped with wireless.
Latest “Month of Apple Bugs”:
1/21 – System Preferences writeconfig Local Privilege Escalation Vulnerability
1/22 – Apple UserNotificationCenter Privilege Escalation Vulnerability
1/23 – Apple QuickDraw GetSrcBits32ARGB() Memory Corruption Vulnerability
1/24 – Apple Software Update Catalog Filename Format String Vulnerability
1/25 – Apple CFNetwork HTTP Response Denial of Service
1/26 – Apple Installer Package Filename Format String Vulnerability
1/27 – Telestream Flip4Mac WMV Parsing Memory Corruption Vulnerability
1/28 – Apple crashdump Privilege Escalation Vulnerability
**********
Three new updates from rPath:
bind/bind-utils (denial of service flaws)
rmake (local arbitrary code execution)
**********
Two new patches from Ubuntu:
Mozilla Firefox (regression flaw)
**********
Two new fixes from Debian:
Mozilla Firefox (multiple flaws)
vlc (format string, code execution)
**********
Three new updates from Mandriva:
vlc (format string, code execution)
xine-ui (format string, denial of service)
**********
Three new patches from Gentoo:
vlc (format string, code execution)
Cacti (SQL injection, command execution)
**********
Virus and malware news of the day:
Half of pirated Vista is malware
About half of the downloads claiming to be free versions of Microsoft’s Vista operating system are actually malicious Trojan horse software, security vendor DriveSentry warned Thursday. IDG News Service, 01/25/07.
**********
From the interesting reading department:
Daylight Saving changes: No Y2K, but there could be headaches
At first blush it may seem like no big deal: clocks will move ahead by an hour three weeks earlier than usual this year. But for today’s networked businesses, the simple change could mean complex problems if IT shops aren’t prepared, industry experts say. Network World, 01/25/07.
RSA: Microsoft to push new antiphishing technology
Microsoft and industry partners are pushing ahead with plans to make the Web a little safer with a new technology to combat phishing. IDG News Service, 01/26/07.
