Ones and Zeros
October 16, 2009, 1:31 PM

Oracle Mega-Patch Coming Next Tuesday

By Ryan Naraine

Oracle has announced plans to ship a Critical Patch Update (CPU) with fixes for at least 38 security vulnerabilities in a wide range of database and server products.

The most serious vulnerabilities affect Oracle Core RDBMS, Oracle JRockit and Oracle Network Authentication.  Read the Oracle advance notice [oracle.com]
   More »

  • Comment
October 16, 2009, 9:29 AM

Microsoft .NET Plug-In Exposes Firefox Users to Malware Attacks

By Ryan Naraine

Remember that Microsoft .NET Framework Assistant add-on that Microsoft sneaked into Firefox without explicit permission from end users?

Well, the code in that add-on has a serious code execution vulnerability that exposes Firefox users to the "browse and you're owned" attacks that are typically used in drive-by malware downloads.   More »

  • Comment
October 16, 2009, 8:44 AM

phpMyAdmin Plugs SQL Injection, XSS Flaws

By Ryan Naraine

A new version of phpMyAdmin has been released to plug two serious security holes that could lead to SQL injection and cross-site scripting attacks.

According to an advisory from the maintainers of the open-source tool, one of the vulnerabilities allow remote hackers to inject arbitrary web script or HTML via a crafted MySQL table name.   More »

  • Comment
October 13, 2009, 11:01 AM

Microsoft Ships Largest Ever Batch of Security Patches

By Ryan Naraine

Microsoft today released its largest ever batch of Patch Tuesday updates to fix a whopping 34 security holes in a wide range of widely deployed software products.

The latest patch batch covers critical vulnerabilities in software products that are bundled with Microsoft's dominant Windows operating system (Internet Explorer and Windows Media Player) -- and several known security problems (SMB v2 and FTP in IIS) for which functioning exploit code has already been publicly released.   More »

  • Comment
October 9, 2009, 11:22 AM

Google Plugs Android Security Holes

By Ryan Naraine

Google has shipped a new version of the Android open-source mobile phone platform to fix a pair of security flaws that could lead to denial-of-service attacks.

According to an advisory from oCERT, a group that handles vulnerability disclosure for open-source projects, the flaws could allow hackers to render Android-powered devices useless.  Here's a link to the oCERT advisory [ocert.org].   More »

  • Comment
October 9, 2009, 8:46 AM

Mozilla Packages Firefox Security Suite Add-Ons

By Ryan Naraine

Mozilla has packaged a suite of security-centric plugins to help Firefox users stay safe while surfing on the Internet.

The package, available here, includes NoScript, Better Privacy, AdBlock Plus and WOT (Web of Trust).   Mozilla has also expanded its Plugin Check to help users identify and patch vulnerable Firefox add-ons.   More »

  • Comment
October 9, 2009, 8:07 AM

Adobe Warns: Unpatched PDF Vulnerability Under Attack

By Ryan Naraine

Adobe has confirmed a critical, unpatched vulnerability in its PDF Reader/Acrobat software is being exploited by malicious attackers.

The vulnerability affects Adobe Reader and Acrobat 9.1.3 and earlier versions on Windows, Macintosh and UNIX.  Adobe described the in-the wild attacks as limited and targeted, suggesting PDF documents rigged with exploits are being attached to e-mails and sent to business targets.   More »

  • Comment
October 9, 2009, 6:26 AM

VMware Authorization Service Haunted by DoS Vulnerability

By Ryan Naraine

A security research firm has issued a warning for a vulnerability in multiple VMware products that can be exploited by malicious people to cause a denial-of-service condition.

The vulnerability is caused due to an error in the VMware Authorization Service when processing login requests.   More »

  • Comment
October 9, 2009, 6:19 AM

Inside the Pay-Per-Install Malware Economy

By Ryan Naraine

Secureworks researcher Kevin Stevens has written a must-read article on the Pay-Per-Install business model (PPI) that is used primarily to spread spyware and malware. 

The article discusses the way the affiliate system works, with layers of files and software programs that power the installation of malware on hijacked Windows computers.   More »

  • Comment
October 8, 2009, 4:41 PM

Patch Tuesday Heads-Up: 13 Bulletins, 8 Critical

By Ryan Naraine

Microsoft is planning a bumper Patch Tuesday next week -- 13 bulletins covering 34 security vulnerabilities in a wide range of products. Eight of the 13 bulletins will be rated "critical," Microsoft's highest severity rating.

According to Microsoft's advance notice, the patches coming on October 13 includes fixes for two serious issues that are well-known and already documented -- a code execution bug in SMB v2 and a gaping hole in FTP in IIS.   More »

  • Comment
October 5, 2009, 3:26 PM

Inside the URLZone Trojan Network

By Ryan Naraine

Security researchers tracking the URL Zone malware/botnet have stumbled upon a new tactic being used by cyber-criminals to hide information on the money mules being used to transfer stolen funds from compromised online bank accounts.

URLZone, which targets computer users in Western Europe, is a botnet of approximately 6,000 hijacked computers that is used primarily to siphon funds from online bank accounts.  It steals between $4,000 and $15,000 from each compromised bank account and uses a nifty trick of modifying the withdrawn amount on the bank's web site to avoid detection by the user.   More »

  • Comment
October 2, 2009, 7:29 AM

'High Risk' Flaw Fixed in Google Chrome

By Ryan Naraine

Google has pushed out a new version of its Chrome browser to fix a high-severity security hole that could lead to malicious code execution attacks.

The vulnerability could be exploited to run arbitrary code within the Google Chrome sandbox, the company said in an advisory.   More »

  • Comment

Blogger Bio

About Ones and Zeros

Ryan Naraine is a security writer social media enthusiast specializing in Internet and computer security issues. He also blogs at ZDNet and previously served as Editor-at-Large/Security at eWEEK and senior editor at Jupiter Media's internetnetnews.com. On this blog, Ryan provides in-depth coverage of hacker attacks, vulnerability research, flaw warnings and news analysis. Follow Ryan on Twitter.

Contact Ryan

 

more

Stay Connected