* Patches from Microsoft, Trustix, FreeBSD, others * Latest "Month of Apple Bugs" * Behind the scenes of MIT's network
Today’s bug patches and security alerts:
Cisco warns of certificate validation flaw
According to a Cisco advisory, “The Cisco Security Monitoring, Analysis and Response System (CS-MARS) and the Cisco Adaptive Security Device Manager (ASDM) do not validate the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) certificates or Secure Shell (SSH) public keys presented by devices they are configured to connect to. Malicious users may be able to use this lack of certificate or public key validation to impersonate the devices that these affected products connect to, which could then be used to obtain sensitive information or misreport information.” An update is available.
**********
Microsoft reissues Excel patch
Microsoft has reissued an Excel security patch, published earlier this month, after the update made it impossible for some Excel 2000 users to open documents. IDG News Service, 01/18/07.
Microsoft Knowledgebase article
**********
Trustix releases new “multi” update
A new update from Trustix fixes flaws in bzip2, kerberos5, squid, wget and xorg-x11. The most serious of the flaws could be exploited to run malicious code on an affected system.
**********
A flaw in jail, a system utility for locking processes inside a specific environment, could be exploited in a symlink attack. Attackers could run arbitrary code on the affected system.
**********
A flaw in poppler, an application for opening PDF documents, could be exploited to send the tool into an infinite loop, resulting in a denial of service.
**********
Multiple flaws have been found in the MIT Kerberos network authentication system. The flaws could be used to gain access to an affected system without the use of proper credentials.
**********
Six new updates from Mandriva:
tetex (denial of service, code execution)
libgtop2 (buffer overflow, code execution)
**********
Latest “Month of Apple Bugs”:
1/16 – Multiple Colloquy IRC Format String Vulnerabilities
1/17 – Apple SLP Daemon Service Registration Buffer Overflow Vulnerability
1/18 – Rumpus Multiple Vulnerabilities
1/19 – Transmit.app ftps:// URL Handler Heap Buffer Overflow
1/20 – Apple iChat aim:// URL Handler Format String Vulnerability
**********
Today’s big virus news:
Storm Trojan floods e-mail boxes
Malicious Trojan horse software claiming to provide information on topics like the deadly storms that have battered Europe this week has infected thousands of computers over the past 24 hours, security vendor Sophos warned Friday. IDG News Service, 01/19/07.
Watch the virus spread
F-Secure Weblog entry on the virus
**********
From the interesting reading department:
Behind the scenes of MIT’s network
Network Manager/Security Architect Jeff Schiller on buying into VoIP and fiber in a big way. Network World, 01/18/07.
