* Patches from Microsoft, Fedora, Trustix, others * Beware Russian mobile worm with alarming new tricks * Management apps could pose security risk, and other interesting reading
Today’s bug patches and security alerts:
Black Hat: Unpatched flaw revealed in Cisco firewall
Cisco just can’t seem to make it through the Black Hat USA conference unscathed. On Wednesday a security researcher showed how an unpatched vulnerability in the company’s PIX firewall appliances that could allow outside attackers to gain access to corporate networks. IDG News Service, 08/04/06.
**********
Microsoft heads for another big Patch Tuesday
August will be another substantial patch month for Microsoft, with the vendor releasing 12 security bulletins next Tuesday to fix holes in both its Windows operating system and the Office productivity suite. IDG News Service, 08/03/06.
**********
New Drupal update patches cross-scripting flaw
According to a Drupal advisory, “A malicious user can execute a cross site scripting attack by enticing someone to visit a Drupal site via a specially crafted link.”
**********
Multiple vulnerabilities have been found in Fedora’s implementation of PHP. The most serious of the flaws could be exploited to run malicious code on the affected machine.
**********
Trustix releases new ‘multi’ update
A new multi update from Trustix fixes flaws in apache, gnupg, libtiff. The most serious of these could be exploited to run malicious code on an affected machine.
**********
New patches for SuSE:
**********
New updates for Gentoo:
TunePimp (buffer overflow, code execution)
OpenOffice.org (multiple flaws)
Mozilla SeaMonkey (multiple flaws)
Mozilla Firefox (multiple flaws)
Mozilla Thunderbird (multiple flaws)
LibVNCServer (Authentication bypass)
Courier MTA (denial of service)
GnuPG (integer overflow, code execution)
**********
New patches for Ubuntu:
GnuPG (integer overflow, code execution)
**********
New fixes for Mandriva:
freeciv (buffer overflow, denial of service)
**********
New patches for Debian:
Mozilla Thunderbird (multiple flaws)
libtunepimp (buffer overflow, code execution)
cfs (integer overflow, denial of service)
ruby1.6 (bypass security restrictions)
GnuPG (integer overflow, code execution)
GnuPG2 (integer overflow, code execution)
freeciv (buffer overflow, denial of service)
**********
Today’s roundup of virus alerts:
Security vendor detects aggressive mobile worm variant
Mobile phone malware writers are up to no good again. A security vendor has detected a new variant of an aggressive Russian mobile worm that uses some alarming new tricks. IDG News Service, 08/04/06.
Troj/Banker-DBA — A virus that can send notification of its existence on a host to remote sites. It is installed as “Expert_Corp.exe” in the Windows folder. (Sophos)
W32/Tilebot-FY — A virus that spreads through network shares by exploiting known Windows flaws. It drops “smsc.exe” in the System folder and allows backdoor access through IRC. (Sophos)
W32/Tilebot-GE — Another Tilebot variant that exploits known Windows flaws and allows backdoor access through an IRC channel. This variant installs itself as “win325b.exe” in the Windows directory. (Sophos)
Troj/Zlob-QF — This virus changes settings for Internet Explorer, registering itself as a Browser Helper Object. It drops “issearch.exe” in the Windows System folder. (Sophos)
W32/IRCBot-QU — A Windows Trojan that could allow outsiders access to the infected host. It is installed as “vmmon32.exe” in the Windows System directory. (Sophos)
**********
From the interesting reading department:
Management apps could pose security risk
Insecure coding and loose deployments of enterprise management applications could turn antivirus, patch management and systems management applications into powerful and malicious botnets, according to research presented at the Black Hat Briefings Conference in Las Vegas. InfoWorld, 08/03/06.
Microsoft looks for ways to combat Blue Pill, code-signing bypass
After security researcher Joanna Rutkowska Thursday demonstrated how it’s possible to circumvent security in Microsoft’s Vista beta software and install a rootkit called Blue Pill, Microsoft said it intends to find ways to stop both potential threats before Vista ships. Network World, 08/04/06.
Juniper researcher Michael Lynn crashes Cisco party at Black Hat
The invite-only party last night that Cisco held at a nightclub for Black Hat conference attendees was crashed by security researcher Michael Lynn, who last year was sued by Cisco for revealing a serious flaw in Cisco routers. NetworkWorld.com, 08/03/06.
