Get hold of yourself

Thursday, July 16, 2009

Researchers Rate All Six Microsoft Patches as Critical

Microsoft rated three of six Patch Tuesday issues as critical, but security researchers say the other three can quickly escalate. Wolfgang Kandek of Qualys said the ISA, Publisher and virtualization vulnerabilities can give a remote attacker control of a computer. Andrew Storms of nCircle hopes for a more complete ActiveX patch later.

Microsoft on Tuesday released six bulletins as part of its monthly patch cycle. Three of the bulletins cover critical flaws, including two unpatched zero-day vulnerabilities. Three other bulletins address important risks that security researchers said can quickly escalate to critical.

Wolfgang Kandek, CTO of Qualys, said Microsoft's advisories should be addressed immediately because they allow an attacker to take complete control of a victim's computer.

Tuesday, July 14, 2009

Microsoft warns of new Office Web Components vulnerability

Microsoft issued an advisory Monday, warning of a new vulnerability in Office Web Components being actively targeted by attackers.The Office Web Components allow users to view spreadsheets, charts and databases on the Web. Microsoft said the vulnerability is in the Spreadsheet ActiveX Control, which is used by Internet Explorer (IE) to display the data in the browser. It is remotely exploitable when a person browses with IE and visits a malicious website. If successfully exploited, an attacker could gain the same user rights as the local user and gain complete control of a system, Microsoft said.

Cloud-based security services should start private

Many early stage cloud vendors have it backwards when it comes to offering cloud-based services. They implement Software as a Service (SaaS) first to demonstrate their vision and then develop enterprise integration features. But the right way to go about it is to support corporate clouds in early product releases.

IT is typically conservative about business risk and likes to retain control over sensitive data and applications. Security SaaS vendors may be better served by allowing IT to start by hosting its own private cloud service, integrated with existing data repositories and administrative systems and then provide a path to the full cloud application environment.

Thursday, July 9, 2009

DDoS attacks hit U.S., South Korean government websites

Security researchers and government IT personnel are investigating a series of distributed denial-of-service (DDoS) attacks wreaking havoc against U.S. and South Korean government websites.According to security researchers, the attacks began last weekend and were responsible for taking out the websites hosting the Federal Trade Commission and Department of Transportation, among others. A spokeswoman for the FTC did not return a phone call seeking comment.

Wednesday, July 8, 2009

Researchers to demonstrate new EV SSL man-in-the-middle hacks

Two security researchers' assault on Extended Validation (EV) SSL certificates will continue next month at the Black Hat Briefings. Alexander Sotirov and Mike Zusman, building on work presented in March at the CanSecWest 2009 security conference, are expected to demonstrate new attacks, including an offline hack
SearchSecurity.com:
To get security news and tips delivered to your inbox, click here to sign up for our free newsletter.
that poisons a site protected by an EV certificate.

Tuesday, July 7, 2009

Microsoft Working on Patch for IE ActiveX Vulnerability

Microsoft has warned of an Internet Explorer vulnerability involving its Video ActiveX Control that could let an attacker take control of a PC. Microsoft said the vulnerability affects Windows XP and Windows Server 2003. It offered a workaround to the IE ActiveX hole that it said should also be used for Windows Vista and Windows Server 2008.

Microsoft Relevant Products/Services has warned of a vulnerability in its Video ActiveX Control that affects Windows XP and Windows Server 2003. The software giant said there have been limited attacks exploiting the vulnerability.

The flaw could be exploited by a visit to a malicious Web site and allow an attacker to take control of a PC. Microsoft said it is working on a security Relevant Products/Services update, and meantime advised that users prevent Microsoft Video ActiveX Control from running in Internet Explorer.
click on the below link to read more:

http://www.enterprise-security-today.com/story.xhtml?story_id=012000VKGFV0

'BugDay' Planned To Fix Bugs in New Firefox 3.5

A "BugDay" has been set for the Mozilla community to focus on bugs in the just-released Firefox 3.5 The bugs in FireFox 3.5 include longer load times, crashes linked to the TraceMonkey JavaScript engine, and Windows XP compatibility. Mozilla plans to release Firefox 3.5.1 with the bug fixes later this month.

Mozilla is scrambling to fix bugs in its just-released Firefox 3.5 browser. Users are posting complaints about problems across the Web.

Those problems include longer load times and crashes linked to the TraceMonkey JavaScript engine. The browser also reportedly has problems with Windows XP. Mozilla has set a community "BugDay" for July 7 to address the bugs in open-source Firefox 3.5.