|
29/08/2007
MSN Messenger vulnerable to ‘highly critical’ webcam flaw
Exploit code for a “highly critical” vulnerability in MSN Messenger has been posted to a Chinese-language forum, prompting Microsoft to urge all users to immediately migrate to Windows Live Messenger 8.1.
The exploit, available here, is caused by an error in the handling of video conversations and can be exploited to cause a heap-based buffer overflow via specially crafted data sent to a user.
28/08/2007
Trend Micro, Zone Labs, ClamAV join list of insecure security products
The three vendors have all acknowledged various security vulnerabilities in a range of desktop and server products that could lead to arbitrary code execution, privilege escalation or denial-of-service conditions.
Trend Micro, which specializes in virus protection software, has issued patches for ServerProtect and the PC-cillin suite.
28/08/2007
Storm Worm Uses YouTube Ruse
Spammers are distributing the Storm Trojan via e-mails purporting to be from friends and containing a false link to a YouTube video.
Security pros are warning that distributors of the Storm Trojan are now using a YouTube video to lure users.
Contained in e-mails with subject lines such as "sheesh man what are you thinking," the malicious link claims to go to YouTube.com, but actually goes to a URL harboring exploit code.
13/07/2007
Dangerous Java flaw threatens virtually everything
Google's Security team has discovered vulnerabilities in the Sun Java Runtime Environment that threatens the security of all platforms, browsers and even mobile devices.
"This is as bad as it gets," said Chris Gatford, a security expert from penetration testing firm Pure Hacking.
"It’s a pretty significant weakness, which will have a considerable impact if the exploit codes come to fruition quickly. It could affect a lot of organisations and users," Gatford told ZDNet Australia.
13/07/2007
Oracle to release 46 patches next week
Oracle will release 46 patches on Tuesday for products including its Oracle Database 10g, Application Server, and E-Business Suite.
Oracle Database will get 20 fixes, two of which patch vulnerabilities that could allow remote execution of code on the network without authentication. The most serious of the database vulnerabilities is ranked "medium" in severity, according to the Common Vulnerability Scoring System, used to rank the severity of security flaws.
|
