* Patches from Microsoft, Trustix, Mandriva, others * Beware new PowerPoint bug * Intel and Symantec push security into firmware, and other interesting reading
Today’s bug patches and security alerts:
Determina patches latest Microsoft flaw
For the second week in a row, independent security researchers have fixed a hole in Microsoft’s software. On Friday, Determina published a free patch for a critical bug in an ActiveX control (called WebViewFolderIcon) that is used by Windows’ GUI. That patch can be found at Determina Security Research. IDG News Service, 09/29/06.
Related:
Attackers targeting new PowerPoint bug
One day after patching a widely exploited flaw in its Internet Explorer browser, Microsoft has a new bug to worry about, this time in PowerPoint. IDG News Service, 09/27/06.
Microsoft still scrambling to patch July bugs
It has become a familiar pattern: A hacker posts exploit code to a security Web site; Microsoft follows soon after with a warning to customers. IDG News Service, 09/28/06.
**********
New “multi” update for Trustix
The latest update for Trustix fixes flaws in OpenSSL and OpenSSH. Both contain multiple flaws that could be exploited to run malicious code on the affected machine.
**********
New updates from Mandriva:
webmin (cross scripting, code execution)
ffmpeg (buffer overflow, code execution)
gstreamer-ffmpeg (buffer overflow, code execution)
mplayer (buffer overflow, code execution)
xine-lib (buffer overflow, code execution)
**********
New patches from Gentoo:
DokuWiki (command injection, denial of service)
**********
New fixes from Debian:
cscope (multiple buffer overflows)
**********
New fixes for Ubuntu:
**********
From the interesting reading department:
FALL IDF – Intel and Symantec push security into firmware
Intel and Symantec plan to release a firmware-based PC security product in the first half of 2007 to stop hackers from disabling virus shields. IDG News Service, 09/29/06.
Ecora giving away system audit tool
Configuration-management company scales down its software to provide customers a lightweight version – for free. Network World, 09/29/06.
Anti-zombie service kills bots dead
Trend Micro has a new service it claims can protect large networks from large-scale botnet attacks. Called the InterCloud Security Service, the real-time system uses a range of patented detection techniques to spot patterns typical of botnets, isolating their traffic before harm can be done, the company said. The technology’s core Behavioral Analysis Security Engine was due to be shown for the first time at this week’s DEMO 2006 event in California.
Video: DEMOFall 2006 – Day 2 highlights
Security and communication is the name of the game as Keith features demonstrators uControl (home security), Trend Micro (beware of the Botnets) and BeHere Corp (conference calls with a 360-degree twist).
