Saturday, October 11, 2008

Firefox Plug-In Updated To Fight Clickjacking Attacks

This information is based on my previous blog in which I mentioned about ‘Clickjacking’.

The NoScript plug-in for Mozilla's Firefox browser has been updated to guard against clickjacking, which security experts call one of the most dangerous problems on the Web. The well-known NoScript plug-in for Firefox is the first to be announced as a defense against clickjacking, but solutions are expected for other Web browsers.

For more info:-

http://www.enterprise-security-today.com/story.xhtml?story_id=022000RB6N64

Web Surfers Face Dangerous New Threat: 'Clickjacking'

A new Web threat has been identified: clickjacking, which can affect the Adobe Flash player and browsers like Firefox, IE, and Google Chrome. Clickjacking lures Web users into unknowingly clicking on a link and revealing private info. There are multiple variants of clickjacking; finding a solution to the clickjack threat will be challenging.

For more info:

http://www.enterprise-security-today.com/story.xhtml?story_id=62355


11 Microsoft Security Updates Due Next Week

Next week will be a busy one for system administrators as Microsoft is planning to ship 11 security updates -- four of them rated critical -- for its products.

T he patches will include fixes for critical security bugs in Windows Active Directory, Internet Explorer, Excel, and the Microsoft Host Integration Server, which integrates Windows computers with IBM mainframes, Microsoft said Thursday in a note on the patches.

The critical Active Directory bug affects Microsoft Windows 2000 Server, but not other versions of Windows, Microsoft said. The Excel bug affects both Windows and Mac OS X versions of the product.

There will also be six less-critical updates, rated "important," by Microsoft, for Windows, and a "moderate" patch for Office. All of these updates are expected around 10 a.m. Pacific time on Tuesday.

Despite the large number of patches, Microsoft hopes that customers will be a little more secure than usual next week. That's because the October Patch Tuesday will mark the debut of two Microsoft security initiatives: the Microsoft Active Protections Program (MAPP) and something called the Exploitability Index.

The MAPP program gives security vendors an edge on writing protection against new attacks by offering them an early peek at the bugs that Microsoft will be patching each month. The program is designed to help Microsoft's security partners avoid a mad scramble as they figure out how attackers might exploit the latest Microsoft flaws. October marks the first time that companies have been given this early information.

The Exploitability Index should make it easier for customers to decide which patches to install first by giving Windows users a better idea of which bugs Microsoft finds most worrying. The index, which will be published with Microsoft's security bulletins next week, will separate the flaws that will simply cause a system crash from more serious bugs that could be used to give attackers control of a victim's machine.

The vulnerabilities listed in Microsoft's bulletins will be rated as "Consistent Exploit Code Likely," "Inconsistent Exploit Code Likely," or "Functioning Exploit Code Unlikely."